CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys Driver

// Intelligence Summary

A vulnerability (CVE-2026-47291) exists in the Windows HTTP.sys kernel-mode driver, allowing for remote code execution (RCE) or denial-of-service (DoS). The flaw stems from an integer overflow during HTTP/1.x header parsing when processed over TLS connections. ### Technical Context

The HTTP.sys parser manages a dynamically allocated buffer reference array. During header parsing, when the count of buffer references reaches capacity, the array is grown by 5 slots. A 16-bit integer overflow occurs when 'capacity' reaches 0xFFFF, leading to a truncated calculation and subsequent kernel pool heap buffer overflow. This requires specific memory layout conditions for RCE but consistently results in kernel-mode system termination. ### Exposure Notes

This vulnerability is reachable only via HTTP/1.x requests encapsulated in TLS. It is triggered by providing a large number of header lines across numerous TLS records to force the integer overflow. Systems with high 'MaxRequestBytes' registry values are particularly susceptible, as the default limit of 16,384 bytes prevents the accumulation of sufficient headers to trigger the overflow. ### Defensive Priority

Organizations must apply the June 2026 security updates. As a compensatory control, administrators should ensure the 'MaxRequestBytes' registry key at HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters is set to a conservative value, ideally 65,535 bytes or lower, to mitigate the attack vector until patching is complete.