CVE-2026-47291
HTTP.sys Remote Code Execution Vulnerability
Beschreibung
Metriken
Weakness-Klassen (CWE)
CWE-190Base
Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
cwe.mitre.org →CWE-122Variant
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
cwe.mitre.org →
Re-Analyse & Statuswechsel
Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.
- CVE Translated2026-07-23 08:10 UTC· nvd@nist.gov
- Translation: Title: varias versiones de Windows, Description: Desbordamiento de entero o ajuste en Windows HTTP.sys permite a un atacante no autorizado ejecutar código a través de una red.
Betroffene Betriebssysteme
windows
microsoft / windows_10_1607
windows
microsoft / windows_10_1809
windows
microsoft / windows_10_21h2
windows
microsoft / windows_10_22h2
windows
microsoft / windows_11_23h2
windows
microsoft / windows_11_24h2
windows
microsoft / windows_11_25h2
windows
microsoft / windows_11_26h1
windows
microsoft / windows_server_2012r2
windows
microsoft / windows_server_2012
windows
microsoft / windows_server_2016
windows
microsoft / windows_server_2019
windows
microsoft / windows_server_2022
windows
microsoft / windows_server_2025