CVE-2026-62735 (CVSS 7.8): Windows Elevation of Privilege Flaw Details and PoC Now Public

A researcher published full technical details and proof-of-concept code for a Windows HTTP.sys vulnerability on September 2026. Tracked as CVE-2026-62735, the flaw carries a 7.8 CVSS score. It lets a local attacker climb to SYSTEM privileges. Microsoft patched it in the August 2026 Patch Tuesday.

Why this matters

HTTP.sys is a kernel-mode driver at the heart of Windows networking. So a bug here runs with the highest privileges. This Windows HTTP.sys vulnerability turns a low-privileged user into SYSTEM. That level of access allows full host control. Now that details and a PoC are public, exploit risk rises sharply.

How the attack works

The security flaw stems from an integer overflow inside the UlpCreateInternalResponseOld function. When calculating the total number of header bytes, the driver fails to prevent integer wrap-around. Consequently, HTTP.sys allocates a smaller nonpaged-pool buffer than the headers actually require.

The CVE-2026-62735 PoC process sends an oversized HTTP response containing nearly 70,000 custom header entries. Next, the user-mode process transmits this response to the kernel driver using a specific IOCTL request. The undersized buffer triggers a heap overflow during header copying. Ultimately, this memory corruption allows the attacker to execute code with elevated SYSTEM privileges.

The researcher demonstrated the crash using a local proof-of-concept. Siyeon Wi first showed the bug at Pwn2Own Berlin 2026. Notably, exploitation needs local access and low privileges, but no user interaction.

Affected versions

The flaw affects a wide range of Windows builds. These include Windows 10, Windows 11, and Windows Server 2012 through 2025. The public demonstration targeted Windows 11 25H2.

Patch and mitigation steps

Apply the August 2026 security update now. Microsoft published no workaround, so patching is the only fix. Check the official Microsoft advisory for the correct KB per build. Where patching must wait, limit local logon rights on shared hosts.

Public technical details and proof-of-concept

This premium content is securely locked. You must upgrade your subscription to access the full threat intelligence report, including detailed mitigation steps, deep-dive analysis, and active exploitation metrics. Your attempt to inspect the DOM will only reveal this placeholder text. Please support our work to read the actual coverage.

Unlock Premium Threat Intelligence

This is a premium content. Upgrade to Pro or Team to unlock full access and remove all reading restrictions.

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.