CVE-2026-50420: Windows HTTP.sys Info Disclosure Flaw

CVE-2026-50420 Overview

CVE-2026-50420 is an out-of-bounds read vulnerability in the Windows HTTP protocol stack (HTTP.sys). The flaw allows an unauthorized attacker with local access to disclose sensitive information from process memory. Microsoft published the advisory on July 14, 2026, and the issue is tracked under CWE-125: Out-of-bounds Read.

The vulnerability requires local attack conditions and does not permit modification or destruction of data. Successful exploitation exposes memory contents that could include credentials, session tokens, or other data handled by HTTP.sys.

Critical Impact
An authenticated local attacker can read out-of-bounds memory from the Windows HTTP driver, exposing sensitive kernel or process data.

Affected Products

Microsoft Windows (versions listed in the Microsoft Security Update Guide)
Windows HTTP protocol stack (HTTP.sys)
See the Microsoft Security Update for CVE-2026-50420 for the complete affected build list

Discovery Timeline

2026-07-14 - CVE-2026-50420 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50420

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode driver that handles HTTP requests on Windows. An out-of-bounds read [CWE-125] occurs when the driver reads memory outside the bounds of an allocated buffer. This behavior leaks adjacent memory contents to an attacker capable of triggering the vulnerable code path.

The attack vector is local, meaning the attacker must already have code execution or interactive access on the target system. The vulnerability impacts confidentiality only. Integrity and availability remain unaffected, and no user interaction is required to complete the exploit.

EPSS data as of July 20, 2026 places the exploitation probability at 0.407%, indicating low near-term likelihood of widespread exploitation. No public proof-of-concept code or exploitation activity has been reported.

Root Cause

The root cause is missing or incorrect bounds validation when HTTP.sys parses or processes HTTP request data. When the driver reads past the end of a buffer, uninitialized or adjacent memory is returned to the caller. Microsoft has not published the specific function or parsing routine responsible in public documentation.

Attack Vector

A local attacker with the ability to send crafted HTTP data to a local HTTP.sys endpoint triggers the out-of-bounds read. The driver returns memory contents beyond the intended buffer boundary. The attacker then extracts the leaked bytes for further reconnaissance or credential harvesting.

The vulnerability manifests in the HTTP request-processing path of HTTP.sys. Refer to the Microsoft Security Update Guide for technical details as they become available.

Detection Methods for CVE-2026-50420

Indicators of Compromise

Unexpected local processes issuing malformed or high-volume HTTP requests to loopback listeners bound by HTTP.sys
Anomalous crashes, error entries, or ETW events originating from the HTTP provider or the HTTP.sys driver
Presence of unauthorized tools performing memory-scraping activity against local HTTP endpoints

Detection Strategies

Monitor Windows Event Tracing (ETW) Microsoft-Windows-HttpService events for abnormal request patterns or parser errors
Correlate unusual local connections to HTTP.sys-bound ports with process ancestry to identify unexpected callers
Baseline legitimate HTTP consumers on each host and alert on deviations, particularly from non-service accounts

Monitoring Recommendations

Enable and forward Windows Security and System event logs to a centralized SIEM for long-term retention and analysis
Track patch deployment status across the Windows fleet using vulnerability management tooling
Watch for privilege escalation or credential access techniques that typically follow information disclosure vulnerabilities

How to Mitigate CVE-2026-50420

Immediate Actions Required

Apply the security update from the Microsoft Security Update Guide to all affected Windows systems
Prioritize patching on multi-tenant hosts, terminal servers, and systems accessible by non-administrative users
Audit local accounts and remove unnecessary interactive logon rights to reduce local attack surface

Patch Information

Microsoft has released a security update addressing CVE-2026-50420. Administrators should consult the Microsoft Security Update Guide entry for build-specific KB articles and deployment guidance. Apply the update through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management pipeline.

Workarounds

No official workaround has been published by Microsoft; patching remains the required remediation
Restrict local logon rights and enforce the principle of least privilege to limit which users can trigger the flaw
Disable or restrict access to unnecessary local services that rely on HTTP.sys where operationally feasible

bash

# Verify HTTP.sys driver version after patching (PowerShell)
Get-Item C:\Windows\System32\drivers\http.sys | Select-Object VersionInfo

# Confirm the relevant KB is installed
Get-HotFix | Where-Object { $_.HotFixID -eq 'KB<insert-KB-number>' }