Executive Summary
CVE-2026-47291 is a critical vulnerability in the Windows kernel-mode HTTP protocol driver (HTTP.sys) that allows for remote code execution (RCE) with kernel privileges. The flaw stems from an integer overflow during the processing of HTTP/1.x headers when delivered via multiple TLS records. By sending a crafted request where each header line is encapsulated in a separate TLS application data record, an attacker can trigger a heap buffer overflow in the kernel pool.
Technical analysis shows the vulnerability is specifically reachable through HTTP/1.x over TLS, as HTTP/2 and HTTP/3 use different parsing paths. Exploitation is a "slow-burn" attack, typically requiring approximately 11 minutes of sustained connection to deliver the 65,536 buffer references necessary to trigger the overflow. Microsoft released a patch for this issue in June 2026.
Successful exploitation poses a severe risk to organizational infrastructure, as it provides an unauthenticated path to kernel-level access on affected Windows systems. Organizations running IIS or other services utilizing HTTP.sys should prioritize patching or implement registry-based mitigations to limit request sizes.