CVE-2026-62735

CVE-2026-62735 is a heap-based buffer overflow in HTTP.sys, the kernel-mode Windows driver that handles HTTP traffic for IIS, Windows Update, and numerous core services. The vulnerability allows local privilege escalation to SYSTEM, and while the CVSS 7.8 score includes 'authorized attacker' and 'local' qualifiers, treat these as procedural labels rather than meaningful scope constraints — any untrusted local user context can trigger the vulnerable kernel code path, and kernel-mode privilege escalation trivially converts that into full system control. The key insight isn't that this is 'another HTTP.sys bug' — it's that this class of vulnerability persists in kernel-mode components for structural reasons that won't be solved by better static analysis. Kernel-mode HTTP parsing code cannot be retrofitted with the runtime bounds instrumentation (stack canaries, heap sanitizers, modern compiler protections) that have dramatically reduced equivalent bug classes in user-mode code. Running these mitigations in the kernel would violate the performance contracts that justify keeping this code in kernel mode. The tooling gap isn't that Microsoft failed to apply existing tools — it's that the tools fundamentally cannot apply to this code surface. Further, HTTP.sys is actively maintained, not dormant legacy code. It now handles HTTP/3 and QUIC parsing in Windows Server — code paths that process network input before authentication completes. A heap overflow in those pre-authentication parsing paths would be reachable in ways the CVE's 'authorized attacker' framing doesn't capture. The risk isn't that Microsoft stopped reviewing HTTP.sys — it's that new parsing code added to an old component inherits legacy constraints without necessarily receiving the same scrutiny as net-new kernel development. You should prioritize this patch based on blast radius, not CVSS. HTTP.sys is a shared infrastructure dependency — every IIS site, Windows Update instance, and Azure service on a host depends on it. A heap overflow here isn't isolated local privilege escalation; it's a single point of failure that collapses the privilege model of every service sharing that kernel context. Exploitation converts any low-privileged foothold into SYSTEM, which then compromises every downstream trust relationship that host participates in. Check whether your systems run HTTP/3 or QUIC-enabled services, as those attack surfaces may reach the vulnerable parsing logic before authentication. Regardless of authentication context, treat any local user code as a potential trigger for this kernel path — your threat model should assume the 'authorized' qualifier describes an attacker who already has local execution capability, not a high barrier.

Reviewed through automated stages and approved by a human before publication.