CVE-2026-62753: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62753 Overview

CVE-2026-62753 is a heap-based buffer overflow vulnerability in the Windows HTTP.sys kernel-mode driver. An authorized local attacker can leverage the flaw to elevate privileges on affected systems. The weakness is classified under CWE-122: Heap-based Buffer Overflow and impacts a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1, and from Windows Server 2012 through Windows Server 2025. Microsoft published guidance in its Security Update Guide alongside the CVE record.

Critical Impact
Successful exploitation allows a low-privileged local user to escalate to elevated privileges with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and arm64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and arm64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62753 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62753

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode HTTP protocol stack that services applications such as Internet Information Services (IIS), WinRM, WSUS, and other components that register URL prefixes with the kernel HTTP listener. A heap-based buffer overflow condition allows an attacker with valid local credentials to write past the bounds of a heap-allocated buffer inside kernel memory. Because HTTP.sys runs in kernel context, corruption of adjacent kernel structures can be steered into elevation of privilege. The issue is tracked as CWE-122.

The attacker must already have low-privileged access on the host, and the attack complexity is high, indicating that reliable exploitation depends on specific conditions such as memory layout, timing, or particular request sequences delivered through the local HTTP kernel interface. When those conditions are met, the attacker gains high impact across confidentiality, integrity, and availability.

Root Cause

Microsoft has not published detailed root cause analysis. The classification as CWE-122 indicates that HTTP.sys copies attacker-influenced data into a heap allocation without correctly enforcing the destination buffer size, producing an out-of-bounds write on the kernel pool.

Attack Vector

The attack vector is local. An authenticated user submits crafted HTTP-layer input that is processed by the kernel HTTP stack. When the flawed code path is reached, the oversized write corrupts kernel heap metadata or adjacent objects. A shaped kernel pool layout can then be used to redirect execution or overwrite privilege tokens, resulting in local privilege escalation. No user interaction is required. See the Microsoft Security Update for CVE-2026-62753 for supported update packages.

Detection Methods for CVE-2026-62753

Indicators of Compromise

Unexpected crashes, bugchecks, or Event Log entries referencing HTTP.sys or http! kernel modules on affected hosts.
New local processes running with SYSTEM privileges spawned from user contexts shortly after HTTP-related requests were processed.
Kernel pool corruption events surfaced via Windows Error Reporting or Live Kernel Reports on servers running IIS, WinRM, or other HTTP.sys consumers.

Detection Strategies

Baseline and alert on token privilege changes for non-administrative accounts, particularly transitions to SYSTEM or elevated integrity levels.
Correlate HTTP.sys service faults with subsequent process creation events under integrity-level or account-context anomalies.
Track installation status of the Microsoft patches referenced in the MSRC advisory for CVE-2026-62753 across the fleet using patch management telemetry.

Monitoring Recommendations

Ingest Windows Security, System, and Application logs into a centralized SIEM and hunt for repeated HTTP.sys faults preceding privilege changes.
Monitor Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for lineage anomalies where standard-user processes spawn elevated children.
Enable kernel memory integrity (HVCI) telemetry and review any exceptions raised on servers hosting HTTP-facing workloads.

How to Mitigate CVE-2026-62753

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62753 to all affected Windows client and server builds.
Prioritize servers running IIS, WinRM, WSUS, and other roles that expose HTTP.sys consumers, as well as multi-user systems where low-privileged local accounts exist.
Audit local account inventories and remove unused interactive logon rights to shrink the population of accounts that can reach the vulnerable code path.

Patch Information

Microsoft has released cumulative security updates that remediate CVE-2026-62753 across supported Windows 10, Windows 11, and Windows Server versions listed in the affected products section. Refer to the Microsoft Security Update Guide entry for CVE-2026-62753 for the exact KB numbers matching each build.

Workarounds

No vendor-supplied workaround is documented; installing the security update is the supported remediation.
Where patching must be delayed, restrict local logon rights and interactive access on hosts running HTTP.sys-dependent services to reduce exposure.
Enable Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) to increase the difficulty of kernel exploitation until updates are deployed.

bash

# Verify installed updates and HTTP.sys file version on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
(Get-Item C:\Windows\System32\drivers\http.sys).VersionInfo

# Confirm VBS and HVCI status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard