Vulnerability CVE-2026-47291 in HTTP.sys: kernel buffer overflow in Windows

TrendAI researchers have identified a flaw in how HTTP/1.x requests over TLS are handled in the HTTP.sys. Due to an overflow in the 16-bit capacity field during dynamic expansion of the buffer array in the UL_REQUEST_BUFFER structure, a kernel heap overflow of more than 500 KB occurs.

A remote unauthenticated attacker can send a specially crafted HTTP request in which each header line is encapsulated in a separate TLS record. If MaxRequestBytes ≥ 262144 and the request contains tens of thousands of header lines, this may lead to a system crash or execution of arbitrary code with kernel privileges. The vulnerability is triggered only when parsing HTTP/1.x over HTTPS; HTTP/2 and HTTP/3 are not affected.

Article: https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys