CVE-2026-62741

The CVSS 7.8 on this CVE massively understates the actual risk, and here's why you should treat this as critical regardless of what the score says: HTTP.sys runs in kernel-mode. This isn't a traditional privilege escalation that gets you from user to administrator over multiple hops—it's a single step from whatever local context you occupy straight to SYSTEM-level code execution. Ring-0 is the foundation everything else sits on, and once you're there, the security boundary is gone. The distinction between 'escalating to admin' and 'executing in kernel' is qualitative, not just quantitative, and it's the gap the CVSS vector string has no language to capture. The phrase 'authorized attacker' is doing more work than most analysts realize. In Microsoft's framing, this typically means any user who can log on locally—not necessarily an administrator. A compromised service account, a standard domain user with the ability to spawn processes, an application pool identity running a web application: these all qualify. The attacker doesn't need to own the machine already. They need one foothold that can run code, and then this vulnerability takes them the rest of the way. That is a dramatically lower bar than the word 'authorized' implies. The integer underflow itself is the mechanism, but the downstream is what matters. Integer underflows in kernel code don't sit idle—they feed immediately into buffer allocations, loop counters, or pointer offsets. The advisory's unusual dual language ('wrap or wraparound') signals that Microsoft patched this fast and may not have fully traced where the underflowed value gets used before disclosure. That's not unusual for kernel vulnerabilities under time pressure, but it means you're patching somewhat blind: you know the bug is fixed, but you don't fully know what the exploitation path looked like. Assume it's worse than the advisory says. The EPSS score of 0.017 is also misleading as a comfort metric. Low probability of exploitation in EPSS models typically reflects either difficulty or narrow configuration exposure—it does not account for the organizational friction of actually deploying the fix. HTTP.sys patches have a track record of disrupting IIS, breaking custom error pages, killing persistent connections, and requiring reboots. The 2014 MS14-084 experience is very much alive in enterprise operations teams. That friction creates a rational incentive to defer patching, and that deferral window is the real exposure—not the theoretical exploit probability EPSS is measuring. Your priority: patch this. The 'authorized attacker' framing and the sub-8 CVSS will cause many organizations to deprioritize it, which is exactly the wrong call. If you're running IIS on Windows Server, if you're running Exchange, if you're running any Microsoft server product that touches HTTP.sys, you need this patch. The blast geometry isn't measured in privilege levels—it's measured in what HTTP.sys touches downstream: every inbound HTTP connection, every application pool, the kernel memory subsystem, everything on that host. A standard user who can run code on an IIS server has a direct path to ring-0, and there's nothing between them and SYSTEM except this one vulnerability. That's not a typical local privilege escalation. That's a kernel exploit by another name, and it deserves to be treated as such.

Reviewed through automated stages and approved by a human before publication.