CVE-2026-62811: Windows 11 23h2 Privilege Escalation Flaw

CVE-2026-62811 Overview

CVE-2026-62811 is a heap-based buffer overflow vulnerability in the Windows HTTP.sys kernel-mode driver. The flaw allows an authenticated local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on August 11, 2026, covering Windows 11 (23H2 through 26H1) and Windows Server 2022 and 2025 across both x64 and ARM64 architectures. The weakness is classified as [CWE-122] Heap-based Buffer Overflow. Successful exploitation grants an attacker higher-integrity code execution, potentially reaching SYSTEM-level privileges given HTTP.sys runs in kernel context.

Critical Impact
Local privilege escalation to SYSTEM through corruption of kernel heap memory in the Windows HTTP protocol stack, affecting all current supported Windows 11 and Windows Server 2022/2025 releases.

Affected Products

Microsoft Windows 11 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
Microsoft Windows Server 2022
Microsoft Windows Server 2025

Discovery Timeline

2026-08-11 - Microsoft releases security update for CVE-2026-62811
2026-08-11 - CVE-2026-62811 published to the National Vulnerability Database (NVD)
2026-08-13 - NVD entry last modified

Technical Details for CVE-2026-62811

Vulnerability Analysis

The vulnerability resides in HTTP.sys, the kernel-mode driver that handles HTTP requests for Windows services including IIS, WinRM, and WSDAPI. A heap-based buffer overflow occurs when the driver allocates a fixed-size buffer on the kernel heap and then writes attacker-influenced data beyond its bounds. Because HTTP.sys operates in ring 0, corruption of adjacent pool memory can be leveraged to modify kernel objects or function pointers.

Exploitation requires local access and low-privileged authenticated context. No user interaction is needed, and the attack scope remains unchanged. A successful write primitive against pool metadata or object headers enables privilege escalation from a standard user to SYSTEM.

Root Cause

The root cause is improper validation of length or offset fields before copying data into a heap-allocated buffer within HTTP.sys. When the driver processes crafted input from a local caller invoking HTTP kernel APIs or interacting with a listening HTTP endpoint from the same host, it fails to enforce the destination buffer's bounds. This condition maps to [CWE-122].

Attack Vector

An attacker authenticates to the target host with any low-privilege account. The attacker then submits crafted HTTP requests or IOCTL-style calls that reach HTTP.sys request-parsing paths. The malformed input triggers an out-of-bounds write on the kernel pool. By grooming the pool prior to the overflow, the attacker overwrites adjacent kernel structures to hijack control flow or escalate the current token to SYSTEM. Verified public exploit code is not available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update CVE-2026-62811 advisory for vendor technical details.

Detection Methods for CVE-2026-62811

Indicators of Compromise

Unexpected HTTP.sys bugchecks or system crashes referencing pool corruption (BugCheck codes 0x19, 0xC2, or 0x139) originating from HTTP.sys.
New processes spawning as SYSTEM from a parent process running under a standard user context shortly after HTTP request activity on the local host.
Anomalous local HTTP traffic to http.sys-bound ports (80, 443, 5985, 5986) originating from non-service user sessions.

Detection Strategies

Monitor Windows Event Log for kernel-mode crash entries (Event ID 1001 WER, Event ID 41 Kernel-Power) correlating with HTTP service activity.
Alert on token elevation events (Event ID 4672) assigned to processes whose parent lineage traces to a low-privileged user session.
Deploy EDR behavioral rules that flag local processes issuing crafted HTTP requests followed by privilege changes on the same host.

Monitoring Recommendations

Track patch compliance across all Windows 11 and Windows Server 2022/2025 endpoints using the Microsoft update catalog identifiers tied to CVE-2026-62811.
Baseline typical HTTP.sys request patterns and alert on deviations, particularly local-loopback traffic from interactive user sessions.
Aggregate kernel crash telemetry and correlate with authentication and process-creation events for early detection of exploitation attempts.

How to Mitigate CVE-2026-62811

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62811 to all affected Windows 11 and Windows Server systems.
Prioritize patching on multi-user systems, jump hosts, terminal servers, and any host where untrusted local accounts exist.
Restrict interactive and remote-interactive logon rights on servers exposing HTTP-based services.

Patch Information

Microsoft published fixes on August 11, 2026 for Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64), Windows Server 2022, and Windows Server 2025. Install the cumulative update associated with CVE-2026-62811 via Windows Update, WSUS, Microsoft Update Catalog, or Intune. Reboot is required for the kernel-mode driver update to take effect.

Workarounds

No official workaround is provided by Microsoft; patching is the required remediation.
Where immediate patching is not possible, disable non-essential HTTP-consuming services (for example, WinRM, IIS, WSDAPI) on hosts where they are not required.
Enforce least-privilege account policies and remove local logon rights for standard users on high-value servers until the update is applied.

bash

# Verify patch status on a Windows host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Query HTTP.sys driver version to confirm update
Get-Item C:\Windows\System32\drivers\http.sys | Select-Object VersionInfo