CVE-2026-62735: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62735 Overview

CVE-2026-62735 is a heap-based buffer overflow [CWE-122] in the Windows HTTP.sys kernel-mode driver. The flaw allows an authorized local attacker to corrupt kernel heap memory and elevate privileges on affected Windows client and server systems. Microsoft published the advisory on 2026-08-11 covering Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. Exploitation requires local access with low privileges and no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the target host.

Critical Impact
A local, authenticated attacker can trigger a heap overflow in HTTP.sys to escalate to SYSTEM-level privileges on affected Windows systems.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62735 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62735

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode HTTP protocol stack used by Internet Information Services (IIS), WinRM, WebDAV, and other Windows HTTP endpoints. A heap-based buffer overflow condition [CWE-122] occurs when the driver writes attacker-controlled data past the bounds of a heap allocation in kernel space. Because HTTP.sys runs in the kernel, memory corruption in this component can be leveraged to overwrite kernel structures and gain arbitrary code execution at ring 0. The advisory categorizes this as an elevation-of-privilege issue rather than a remote code execution flaw, indicating the attack surface requires local access.

Root Cause

The root cause is improper bounds checking on a heap allocation inside HTTP.sys when processing HTTP request data. Insufficient validation of length fields or copy operations allows the driver to write beyond the allocated buffer. This overflows adjacent kernel heap chunks and corrupts pool metadata or neighboring objects.

Attack Vector

An attacker with local, low-privilege access sends crafted HTTP traffic to a HTTP.sys endpoint on the same host. The malformed request triggers the overflow during parsing or buffering. By shaping the kernel pool layout beforehand, the attacker overwrites a controlled kernel object to hijack execution flow. Successful exploitation yields SYSTEM privileges. No user interaction is required, and the attack complexity is low.

No verified public exploit or proof-of-concept has been released for CVE-2026-62735 at the time of publication. Technical specifics of the vulnerable code path are available through the Microsoft Security Response Center advisory.

Detection Methods for CVE-2026-62735

Indicators of Compromise

Unexpected crashes or bugchecks referencing HTTP.sys in Minidump files or Event ID 1001 (BugCheck) entries in the System event log.
New or unauthorized SYSTEM-context processes spawned shortly after HTTP requests to local listeners on ports 80, 443, 5985, or 5986.
Anomalous local HTTP traffic from low-privileged user sessions targeting http://localhost or http://127.0.0.1 endpoints.

Detection Strategies

Monitor kernel crash telemetry for repeated faults in HTTP.sys or associated pool corruption bugchecks such as BAD_POOL_HEADER (0x19) and KERNEL_MODE_HEAP_CORRUPTION (0x13A).
Correlate local HTTP client activity from non-service accounts with subsequent privilege changes or token elevation events (Event ID 4672).
Baseline HTTP.sys request patterns per host and alert on malformed requests with oversized headers, chunked encodings, or unusual URL lengths.

Monitoring Recommendations

Enable Windows kernel-mode dump collection and forward WER reports to a central SIEM for post-incident analysis.
Ingest Sysmon Event ID 1 (Process Create) and Event ID 10 (Process Access) to identify SYSTEM-context child processes originating from services hosting HTTP.sys.
Track patch compliance on all Windows client and server assets against the August 2026 security update baseline.

How to Mitigate CVE-2026-62735

Immediate Actions Required

Apply the Microsoft August 2026 security update to every affected Windows 10, Windows 11, and Windows Server release listed in the advisory.
Prioritize patching servers exposing HTTP.sys-backed services such as IIS, WinRM, and WebDAV, even when only reachable locally.
Audit local accounts and remove unnecessary interactive logon rights to reduce the population of users able to trigger the flaw.

Patch Information

Microsoft has released security updates addressing CVE-2026-62735 for all supported affected products. Refer to the Microsoft CVE-2026-62735 advisory for the specific KB article and update package corresponding to each Windows build. Deploy patches through Windows Update, WSUS, Microsoft Endpoint Configuration Manager, or Intune based on your environment.

Workarounds

No official workaround is published by Microsoft; patching is the required remediation path.
Where immediate patching is not feasible, restrict local logon rights and disable non-essential HTTP-based services that depend on HTTP.sys.
Enforce application allowlisting to limit the ability of low-privileged users to execute arbitrary binaries that could trigger the overflow.

bash

# Verify HTTP.sys version and check for the applied patch on a Windows host
Get-Item C:\Windows\System32\drivers\http.sys | Select-Object VersionInfo

# List installed security updates and confirm the August 2026 KB is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20