Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-47291 – Unauthenticated Remote Code Execution via Integer Overflow – Windows HTTP.sys

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Note: To get a list of potentially affected targets within your attack surface, please contact IONIX support.

Summary

CVE-2026-47291 is a critical remote code execution vulnerability in http.sys, the Windows kernel-mode HTTP driver that underlies IIS, WCF, WinRM, and other Windows HTTP services. An unauthenticated remote attacker can trigger an integer overflow in the driver’s request-parsing logic by sending a specially crafted HTTP request exceeding 65,535 bytes, leading to a heap buffer overflow in kernel memory and arbitrary code execution with kernel-level privileges. It carries a CVSS v3.1 base score of 10.0 (Critical).

Technical details

  • Root cause: When http.sys processes an HTTP request, it performs 16-bit integer arithmetic on the total request size. A request whose header block reaches or exceeds 65,535 bytes triggers an integer overflow (CWE-190), causing the computed allocation size to wrap around to a small value and resulting in a heap buffer significantly smaller than the data written into it.

  • Trigger conditions: The attacker must send an HTTP request whose total size (request line + headers) meets or exceeds 65,535 bytes. The MaxRequestBytes registry setting controls the maximum accepted request size; the Windows default is 16,384 bytes. Only systems where this value has been raised to 65,535 bytes or higher are within the exploitability range.

  • Attack vector: Remote, unauthenticated — no credentials, session, or user interaction required. The vulnerable code executes in the Windows kernel driver before any application-level processing.

  • Impact: Successful exploitation results in arbitrary code execution at kernel level. The scope of impact extends beyond the compromised component (S:C), with Confidentiality, Integrity, and Availability all rated High.

  • Key finding: Microsoft MSRC confirmed that the default Windows MaxRequestBytes value (16,384 bytes) is not within the exploitable range. Only servers where this value has been explicitly raised above 65,535 are affected.

Affected software

  • Windows Server 2025, Windows Server 2022, Windows Server 2019, Windows Server 2016

  • Windows 11, Windows 10

Microsoft has released patches addressing this vulnerability. Refer to the MSRC advisory for the full list of affected build numbers.

Severity

  • CVSS v3.1 Base Score: 10.0 (Critical)

  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • CWE: CWE-190 – Integer Overflow or Wraparound

Mitigation and recommended actions

  • Immediate: Apply the Microsoft security update for CVE-2026-47291. Patch details are available at the MSRC advisory linked below.

  • Interim mitigation: This step is only required for servers where the default MaxRequestBytes value has been explicitly increased above 65,535. If that is the case, set it back to a value below 65,535 under HKLMSYSTEMCurrentControlSetServicesHTTPParametersMaxRequestBytes and restart the HTTP service or reboot. Servers that have never had this value changed from the Windows default (16,384 bytes) are not within the exploitable range and require no configuration change.

IONIX Status

The IONIX research team has analyzed the exploitability conditions for CVE-2026-47291 and developed detection capability to identify assets within the exploitable configuration range. To get a list of potentially affected targets within your attack surface, please contact IONIX support.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge