OnlyPatch
Windows HTTP.sys

CVE-2026-21250 — Windows HTTP.sys Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.0104 🔬 Patch diffed 2026-02 archive

Executive Summary

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-822: Untrusted Pointer Dereference
Released Feb 10 2026
Last Updated Feb 10 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.0104 — 0.60444 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.0104
probability of exploitation in the next 30 days
0.60444 percentile - updated 2026-07-25
View on FIRST.org

Affected Products

3 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 24H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5073379 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7840 10.0.26100.7781 Yes None Windows 11 Version 24H2 for x64-based Systems 5077212 (Security Hotpatch Update) 5077181 (Security Update) Important Elevation of Privilege 5074109 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7781 10.0.26100.7840 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 25H2 for x64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5075897 (Security Update) Important Elevation of Privilege Yes

Patches

2 patches
Article Type Restart
5077179 Security Update Yes
5075897 Security Update Yes

Patch Diff

ghidriff · http.sys (KB5077181)

Patch diff 10.0.26100.7309 -> 10.0.26100.7824

Pre-patch version 10.0.26100.7309 Download
Post-patch version 10.0.26100.7824 Download
Function Address Change Note
UlExtractAndAppendAuthenticationResponseInfo 14009d2f0 -> 14009d490 code, length, address similarity 0.38
UlpRebuildResponseHeaders 14010cd9c -> 14010d44c code, length, address similarity 0.63
UxQuicConnectionGetPeerIssuerListClient 1400e2624 -> 1400e2cb8 code, length, address similarity 0.79
UxSslGetTlsCipherInfo 1401173a8 -> 1401179d8 code, length, address similarity 0.21
UlpSetUrlInfo 1400309b0 -> 140030a90 code, refcount, length, address, called similarity 0.28
WPP_SF_qLqqqq 1401a5238 refcount, calling similarity 1.0
UlpRejectFlushedRequests 140091f8c -> 140090fe4 code, length, sig, address, called similarity 0.37
UlpPcwCollectInstances 14008c19c -> 14008c83c length, sig, address, called similarity 0.43
UlThreadPoolEnqueueWorkItem 14001db20 -> 14001dc00 refcount, address, calling similarity 1.0
UxTlGetTcpInitialPacketTtl 140135b68 -> 140136328 code, length, sig, address similarity 0.67
UxSslConnectionControl 140003870 code, length, calling similarity 0.97
WPP_SF_qDL 1401b8fb0 -> 1401b8f90 refcount, address, calling similarity 1.0
UlSetConfigGroupProperty 14008f5d4 -> 140097064 code, length, address, called similarity 0.38
UxpPktMonNtStatusToDropReason 1401378e0 -> 1401380b0 refcount, address, calling similarity 1.0
UxQuicCreateConnection 1400e3f40 -> 1400e4620 code, length, sig, address similarity 0.31
NTOSKRNL.EXE::KeSetEvent EXTERNAL:000000fe refcount, calling similarity 1.0
UlProbeForRead 140067c30 -> 140062cb0 refcount, address similarity 1.0
UlHkeBuilderCopyFixedHeaders 140127fe0 -> 140128630 code, length, address similarity 0.99
UlUpdateParsedHeader 1401329e4 -> 140133024 refcount, address similarity 0.96
UlpFreeHttpRequest 14002cad0 -> 14002cbb0 refcount, address, called similarity 0.9
UxQuicStreamConnectionControl 1400f47e0 -> 1400f4e30 code, length, address similarity 0.9
wil_details_FeatureReporting_IncrementUsageInCache 1400b713c -> 1400b7830 length, address similarity 1.0
memcpy 14014db80 -> 14014e300 refcount, address, calling similarity 1.0
UlpCompleteSendCacheEntryWorker 140043bb0 -> 14003f1b0 code, refcount, length, address, called similarity 0.62
UxPktMonTraceDropSslWithNtStatus 14013776c -> 140137f3c refcount, address, calling similarity 1.0
UlpGenerateRangeResponseHeaders 140102e88 -> 1401034d8 code, length, address, called similarity 0.77
UlpCheckIfBypassRangeProcessing 14008e754 -> 14009a6c0 code, length, sig, address, called similarity 0.29
memset 14014de80 -> 14014e600 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::ExpInterlockedPushEntrySList EXTERNAL:0000003a refcount similarity 1.0
UxPodReferenceSilo 14001de20 -> 14001df00 refcount, address, calling similarity 1.0
UlpHkeBuilderModifyStatusCode 140129d3c -> 14012a37c refcount, address, calling similarity 0.6
UlQueryUrlGroupIoctl 1400c9770 -> 1400c9e20 code, length, address similarity 0.79
UlCopyRequestToIrp 140049bb4 -> 140045104 code, length, address, called similarity 0.68
UlProbeAnsiString 140069070 -> 1400640f0 refcount, address similarity 1.0
UlPrepareParsedHeaderRangeResponse 14008e050 -> 14008dfb4 code, length, address similarity 0.19
UxpQuicGetTlsParam 1400ed6c4 -> 1400eddd4 refcount, address, calling similarity 1.0
UlpActivateThreadPoolQueue 14001afa0 -> 14001b080 refcount, address, calling similarity 1.0
UlQueryConfigGroupProperty 1400ab88c -> 1400abd5c code, length, address similarity 0.28
UcQueryClientConnectionProperty 1401409a4 -> 140141174 code, length, address, called similarity 0.62
UcCaptureConnectionParameters 140146320 -> 140146b50 code, length, address, called similarity 0.34
UxQuicConnectionCopyBindings 1400e1754 -> 1400e1ea4 code, length, address similarity 0.89
UxSslMapSecurityStatusToErrorNtStatus 14009ed94 -> 14009f264 refcount, address, calling similarity 1.0
UlSetUrlGroupIoctl 140037880 -> 140098b10 code, length, address similarity 0.95
UxpSslSetConnectionState 14007da40 -> 14007e0e0 refcount, address, calling similarity 0.86
UxpQuicQueryConnectionInfo 1400ef0f4 -> 1400ef804 code, length, address similarity 0.45
UcStartClientConnectionIoctl 1401429a0 -> 1401431e0 length, address similarity 0.87
UxSslFreeAscContext 1400668c0 -> 1400732a0 refcount, address similarity 0.96
UlpCopyRequestInformation 1400061a8 -> 140006188 code, length, sig, address, called similarity 0.31
UxpSslQuerySslConnectionInfo 14009b9f0 -> 14009bba0 code, length, address similarity 0.5
WPP_SF_iq 1401b9308 -> 1401b92e8 refcount, address, calling similarity 1.0
WPP_SF_id 1401b8c1c -> 1401b8bfc refcount, address, calling similarity 1.0
UlGenerateTrailers 1400741f0 -> 14009de00 code, refcount, length, address similarity 0.34
UxpQuicConnectionCopyCertBlob 1400e9b1c -> 1400ea1ec code, length, sig, address, called similarity 0.4
UlpAssignThreadPoolWork 14011b8b0 -> 14011bf00 refcount, address similarity 1.0
UxpSslInitiateAscHandler 140065050 -> 140060650 code, refcount, length, sig, address, called similarity 0.13
NTOSKRNL.EXE::KeGetCurrentProcessorNumberEx EXTERNAL:00000094 refcount similarity 1.0
NTOSKRNL.EXE::PsGetCurrentServerSilo EXTERNAL:00000131 refcount similarity 1.0
UlpCompleteSendToExtensionWorker 140109730 -> 140109df0 code, length, address similarity 0.95
wil_details_FeatureReporting_RecordUsageInCache 1400b722c -> 1400b7914 code, length, address similarity 0.73
UxpPktMonTraceSslDropInternal 140137d2c -> 1401384fc refcount, address, calling similarity 1.0
wil_details_FeatureReporting_IncrementOpportunityInCache 1400b7058 -> 1400b7758 length, address similarity 1.0
UxpSslWaitForAscHandler 140064758 -> 14005fd58 code, length, address, called similarity 0.89
WPP_SF_ 1401a56d0 refcount, calling similarity 1.0
UlpFlushPendingRequests 14006aff8 -> 140066078 length, address, called similarity 1.0
UxSslAcceptSecurityContextCallback 140076e80 -> 140078180 refcount, address similarity 0.97
UlCopyRequestToBuffer 14004e2dc -> 14004988c code, length, address, calling, called similarity 0.79
UxGetInputBuffer 1400222f0 -> 1400223d0 refcount, address similarity 0.94
UlBugCheckEx 14001cc10 -> 14001ccf0 refcount, address, calling similarity 1.0
WPP_SF_L 1401b910c -> 1401b90ec refcount, address, calling similarity 1.0
UlSetRequestProperty 1400cb260 -> 1400cb930 code, length, address similarity 0.98
KSECDD.SYS::SspiCreateAsyncContext EXTERNAL:0000017d refcount similarity 1.0
UlpCopyInitialPacketTtl 140105584 -> 140105c14 code, length, address similarity 0.74
UxSslAllocateAscContext 140066740 -> 140073120 refcount, address, calling similarity 0.97
UxTlConnectionControl 140005c60 -> 140005c50 code, length, address, calling similarity 0.5
UlQueryRequestFastIo 1400bb330 -> 1400bba00 code, length, address similarity 0.98
NTOSKRNL.EXE::KeGetCurrentNodeNumber EXTERNAL:00000140 refcount, calling similarity 1.0
KSECDD.SYS::SspiSetAsyncNotifyCallback EXTERNAL:0000017c refcount, calling similarity 1.0
UlQueryRequestProperty 1400c8968 -> 1400c9028 code, length, address similarity 0.2
UlGenerateDateHeader 140060510 -> 14005bb30 code, length, address similarity 0.76
NTOSKRNL.EXE::ExAllocatePool3 EXTERNAL:00000144 refcount, calling similarity 1.0
UlFeatureSupportedFastIo 1400bafc0 -> 1400bb6a0 code, length, address similarity 0.86
UlpCopyGlobalCounters 140090808 -> 1400af20c code, name, fullname, refcount, length, sig, address, calling similarity 0.96
UlpCopyUrlGroupCounters 140091e84 -> 1400af2f4 code, name, fullname, refcount, length, sig, address, calling similarity 0.92
WPP_SF_ili 1401b2518 -> 1401a9e5c code, name, fullname, refcount, length, sig, address, calling similarity 0.7
UxpQuicConnectionCopyCertBlob32 14014db80 -> 1400ea280 code, name, fullname, refcount, length, sig, address, calling, called similarity 0.04
UlpPcwCopyGlobalCounters 140090808 -> 14013527c code, name, fullname, refcount, length, sig, address, calling, called similarity 0.24
UlPcwCopyUrlGroupCounters 140091e84 -> 140134db8 code, name, fullname, refcount, length, sig, address, calling, called similarity 0.38
View full diff report

Known Exploits

Acknowledgments

Anonymous
Matthew Cox with Microsoft

On This Page