CVE-2026-62741: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62741 Overview

CVE-2026-62741 is an integer underflow vulnerability in the Windows HTTP.sys kernel-mode driver. The flaw allows an authorized local attacker to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on August 11, 2026, and the issue affects all currently supported Windows 10, Windows 11, and Windows Server releases. The weakness is categorized as a heap-based buffer overflow [CWE-122] triggered through arithmetic wraparound. Successful exploitation grants an attacker higher-integrity code execution in the kernel context.

Critical Impact
A low-privileged local user can trigger an integer underflow in HTTP.sys and achieve full confidentiality, integrity, and availability compromise on the host.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62741 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62741

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode HTTP protocol stack that services requests for IIS, WinRM, WSDAPI, and other Windows HTTP endpoints. An integer underflow occurs when a size or length value is decremented below zero, wrapping to a large unsigned value. That oversized value is then used in subsequent memory operations against a heap-allocated buffer, producing a heap-based buffer overflow [CWE-122]. Because HTTP.sys runs in kernel mode, memory corruption can be steered into elevation of privilege from a standard user context to SYSTEM.

Root Cause

The root cause is unsafe arithmetic on a length or offset field parsed from attacker-controlled input. The value is treated as unsigned after a subtraction that can wrap, bypassing bounds checks. Downstream copy or write operations then operate past the intended buffer boundary in the paged or non-paged pool.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. An authorized attacker on the host sends crafted HTTP requests or interacts with a component that funnels data into HTTP.sys, triggering the underflow path. Exploitation yields kernel memory corruption suitable for privilege escalation. Refer to the Microsoft Security Update CVE-2026-62741 for vendor-confirmed technical scope.

Detection Methods for CVE-2026-62741

Indicators of Compromise

Unexpected HTTP.sys crashes, bugchecks, or System process faults referencing the HTTP stack in the Windows Event Log.
New or unexpected local processes spawning children with SYSTEM integrity shortly after HTTP request activity.
Anomalous URL handling errors or malformed request patterns targeting local HTTP listeners on ports 80, 443, 5985, or 5986.

Detection Strategies

Monitor kernel crash telemetry and WER reports that implicate HTTP.sys or the HTTP service.
Correlate local HTTP client activity from non-service accounts with subsequent token elevation events (Event ID 4672, 4688).
Baseline HTTP listener behavior on endpoints and flag deviations in request length fields or chunked encoding handling.

Monitoring Recommendations

Enable Windows kernel and Sysmon logging for process creation, driver load, and integrity-level changes.
Forward HTTP.sys error logs from %SystemRoot%\System32\LogFiles\HTTPERR for centralized review.
Alert on privilege escalation chains where a low-privileged process is followed by SYSTEM-level activity on the same host.

How to Mitigate CVE-2026-62741

Immediate Actions Required

Apply the August 2026 Microsoft security update referenced in the MSRC advisory to all affected Windows client and server builds.
Prioritize patching of internet-adjacent servers running IIS, WinRM, or any service that binds through HTTP.sys.
Audit which local accounts and services can reach HTTP endpoints on each host and restrict them to the minimum required.

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-62741 for Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012 through 2025. Consult the Microsoft Security Update CVE-2026-62741 page for the specific KB article and build numbers per SKU.

Workarounds

Restrict local logon rights and remove unnecessary interactive accounts on servers hosting HTTP listeners.
Stop and disable non-essential services that bind through HTTP.sys on systems that cannot be immediately patched.
Apply application allowlisting to prevent unauthorized binaries from issuing crafted local HTTP requests.

bash

# Configuration example: list HTTP.sys URL reservations and stop non-essential HTTP services
netsh http show urlacl
Get-Service | Where-Object { $_.Name -in 'W3SVC','WinRM','WMSvc' } | Stop-Service -Force
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10