Zero Day Initiative Discloses Windows http.sys Integer Overflow Leading to Privilege Escalation
A local privilege escalation vulnerability in Microsoft's http.sys driver, ZDI-26-536, allows attackers with low-privileged code execution to gain SYSTEM privileges.
The Zero Day Initiative (ZDI) has publicly disclosed a critical vulnerability affecting Microsoft Windows, identified as ZDI-26-536. This flaw resides within the http.sys driver, a core component responsible for handling HTTP traffic for the operating system. Attackers who manage to execute low-privileged code on a target system can leverage this vulnerability to elevate their privileges to the highest level, effectively gaining SYSTEM access.
The vulnerability stems from an integer overflow condition that occurs due to improper validation of user-supplied data. Before allocating a buffer, the http.sys driver fails to correctly check the size of the input, leading to an overflow. This overflow can then be exploited by an attacker to manipulate memory allocations and execute arbitrary code within the context of the SYSTEM account. The CVSS score assigned by ZDI is 8.8, indicating a high severity.
Exploitation requires an attacker to first gain a foothold on the system with existing low-privileges. This could be achieved through various means, such as exploiting another vulnerability, tricking a user into running malicious code, or compromising a service that runs with limited permissions. Once initial code execution is established, the attacker can then chain this http.sys vulnerability to achieve full control over the affected Windows machine.
Microsoft has acknowledged the vulnerability and released a security update as part of its regular patch cycle to address ZDI-26-536. The corresponding CVE identifier for this flaw is CVE-2026-62735. Users and organizations are strongly advised to apply the latest security patches provided by Microsoft to mitigate the risk of exploitation.
The disclosure timeline indicates that ZDI initially reported the vulnerability to Microsoft on May 21, 2026. Following coordinated disclosure efforts, the advisory was publicly released on August 11, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered by Siyeon Wi.
This type of local privilege escalation vulnerability is a common target for attackers, as it allows them to move from a compromised, low-privilege user to a system-wide administrator. Such access is crucial for attackers seeking to deploy ransomware, steal sensitive data, or establish persistence within a network.
While the vulnerability requires initial code execution, its presence in a fundamental Windows component like http.sys makes it a significant concern. Organizations should prioritize patching this vulnerability to prevent potential post-exploitation activities by threat actors.