CVE-2026-61937: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-61937 Overview

CVE-2026-61937 is an integer overflow vulnerability in the Windows HTTP protocol stack driver (HTTP.sys). An authorized local attacker can trigger the flaw to elevate privileges on affected Windows client and server systems. Microsoft classifies the issue under CWE-122 (Heap-based Buffer Overflow), since the integer wraparound leads to undersized heap allocations that are subsequently overflowed. The vulnerability affects every currently supported Windows 10, Windows 11, and Windows Server release. No public proof-of-concept exploit is available at the time of publication, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A low-privileged local user can exploit HTTP.sys to gain SYSTEM-level privileges on unpatched Windows hosts.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61937 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61937

Vulnerability Analysis

The defect resides in HTTP.sys, the kernel-mode driver that parses HTTP requests for IIS and any other service built on the HTTP Server API. During request processing, an arithmetic calculation on attacker-influenced size fields wraps around the integer range and produces a value smaller than intended. This truncated value is then passed to a heap allocator, resulting in an undersized buffer that is subsequently written with a larger payload. The out-of-bounds write corrupts adjacent kernel heap structures.

Because HTTP.sys runs in kernel context, a successful exploit yields code execution at SYSTEM. The attack requires the adversary to already possess a valid local account on the target host, which reduces exposure but is trivial in shared or multi-tenant environments such as terminal servers and jump hosts.

Root Cause

The root cause is improper validation of arithmetic on 32-bit size or length values inside HTTP.sys. When the product of two attacker-controlled fields exceeds 0xFFFFFFFF, the result wraps to a small integer. Downstream allocation routines treat the wrapped value as a legitimate size, producing a heap buffer that cannot hold the actual data written into it.

Attack Vector

Exploitation requires local access and low privileges. An attacker submits a crafted HTTP request or invokes the HTTP Server API in a way that drives the vulnerable arithmetic path. The resulting heap-based buffer overflow corrupts kernel objects the attacker can shape to hijack control flow or overwrite security tokens. No user interaction is required, and the confidentiality, integrity, and availability impact is high.

No verified public exploit code is available. Refer to the Microsoft Vulnerability Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-61937

Indicators of Compromise

Unexpected HTTP.sys driver crashes or bugchecks referencing pool corruption, especially BAD_POOL_HEADER (0x00000019) or KERNEL_MODE_HEAP_CORRUPTION (0x0000013A).
New or unexpected processes spawned as NT AUTHORITY\SYSTEM shortly after w3wp.exe or other HTTP-consuming services process traffic.
Anomalous token duplication or process handle activity originating from services that consume the HTTP Server API.

Detection Strategies

Monitor Windows Event Log channels System and Microsoft-Windows-HttpService/Trace for repeated HTTP.sys errors, resets, or driver restarts.
Correlate low-privileged user sessions with subsequent SYSTEM-level process creation using Sysmon Event ID 1 and Windows Security Event ID 4688.
Alert on kernel crash dumps that reference the HTTP.sys module, since heap corruption attempts commonly produce bugchecks before a working exploit is achieved.

Monitoring Recommendations

Enable Sysmon with process creation, image load, and driver load logging on all servers exposing IIS or WinRM.
Forward Windows kernel and HTTP service telemetry to a centralized SIEM and retain crash artifacts for forensic review.
Baseline expected callers of HTTP.sys and alert on unusual local processes issuing HTTP Server API calls.

How to Mitigate CVE-2026-61937

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory to all affected Windows client and server builds.
Prioritize patching multi-user hosts such as Remote Desktop Session Hosts, Citrix servers, and developer jump boxes where local access is broadly available.
Audit local accounts and remove standing local logon rights that are not required for business operations.

Patch Information

Microsoft has released fixes through the standard Windows Update and Microsoft Update Catalog channels for all supported builds listed in the advisory. Administrators should verify that the corresponding cumulative update or monthly rollup for their build is installed on every affected host. The advisory lists the specific KB article per platform.

Workarounds

Restrict interactive and Remote Desktop logon to trusted administrative accounts using Group Policy User Rights Assignment.
Disable or stop any HTTP-consuming service (IIS, WinRM, Print Spooler HTTP endpoints) on hosts that do not require it, reducing the attack surface of HTTP.sys.
Enforce application allowlisting through Windows Defender Application Control (WDAC) or AppLocker to hinder execution of exploit tooling by low-privileged users.

bash

# Example: verify the HTTP.sys driver version and check installed updates on Windows
Get-Item C:\Windows\System32\drivers\HTTP.sys | Select-Object VersionInfo
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10