CVE-2026-33096

What it actually does

This vulnerability is an unauthenticated, network-reachable out-of-bounds read in Windows HTTP.sys, the kernel-mode HTTP protocol stack used by IIS and other Windows services that rely on the HTTP Server API. A specially crafted HTTP request can cause HTTP.sys to read memory outside the expected bounds and trigger a service failure or system-level crash condition, resulting in denial of service. The flaw does not provide confidentiality or integrity impact under the published scoring, but it has high availability impact because exploitation requires no authentication, no user interaction, and low attack complexity over the network.

Why it matters to the business

Successful exploitation can make Windows servers or workstations that expose HTTP.sys-based services unavailable, disrupting web applications, management endpoints, APIs, or services hosted on affected Windows versions. Internet-facing IIS servers, internal web services, and systems exposing Windows HTTP-based management interfaces are the highest operational concern. Although there is no CISA KEV listing, no known ransomware use, no public exploit maturity reported, and EPSS is low and flat, the unauthenticated network attack surface means exposed systems should still be patched through normal vulnerability remediation timelines, with accelerated handling for business-critical or externally reachable services.

How an attack unfolds

An attacker first identifies a Windows host exposing a service backed by HTTP.sys, such as IIS or another application using the Windows HTTP Server API. The attacker then sends a malformed HTTP request designed to exercise the vulnerable parsing or handling path in HTTP.sys. Because HTTP.sys operates in kernel mode and processes the request before application-level authentication, the request can be delivered without valid credentials and without interaction from a user. If the vulnerable code path is reached, HTTP.sys performs an out-of-bounds read and the affected service or host can become unstable, stop responding, or crash, denying legitimate users access until the service recovers or the system is restarted. Current public information indicates denial of service rather than code execution or data theft.

How to fix it

Apply the Microsoft security update or cumulative update that fixes CVE-2026-33096 for all affected platforms: Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2022; Windows Server 2022 23H2; and Windows Server 2025. Exact fixed build numbers were not provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or enterprise patch tooling to deploy the relevant April 2026 or later cumulative security update for each affected OS version. Prioritize internet-facing IIS and HTTP.sys-backed services, systems hosting critical web applications or APIs, and servers exposing Windows Remote Management over HTTP/HTTPS. If immediate patching is not possible, reduce exposure by blocking untrusted access to HTTP.sys-backed services at firewalls or load balancers, disabling unused IIS sites and HTTP Server API listeners, restricting WinRM to trusted management networks, enforcing rate limits at reverse proxies where applicable, and ensuring service monitoring can restart or fail over impacted workloads.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative security update that supersedes the April 2026 fix for this issue. Validate through Windows Update history, enterprise patch compliance tooling, or by comparing the installed HTTP.sys driver version against Microsoft’s patched baseline for the relevant Windows release. Review listening services to ensure unnecessary HTTP.sys-backed endpoints are not exposed, including IIS bindings and HTTP.sys URL reservations. From a network perspective, confirm that only intended ports and sources can reach HTTP.sys-backed services. Where safe and authorized, perform non-destructive vulnerability scanning with updated scanner plugins that specifically check for this vulnerability rather than attempting to trigger a crash.

Typical attack path

1. Scan for Windows systems exposing HTTP.sys-backed HTTP or HTTPS services, commonly on ports such as 80, 443, 5985, or 5986.
2. Fingerprint the service as IIS, WinRM, or another Windows HTTP Server API consumer where possible.
3. Send specially crafted HTTP requests intended to trigger the vulnerable HTTP.sys out-of-bounds read condition.
4. Observe whether the target stops responding, resets connections, returns service errors, or reboots/crashes.
5. Repeat requests to sustain denial of service if the service or host automatically recovers.

How to detect it

Because the vulnerability causes denial of service rather than a distinctive post-compromise footprint, detection should focus on evidence of abnormal HTTP.sys failures, IIS or HTTP-based service disruption, system bugchecks, and suspicious request bursts immediately before downtime. Review Windows System event logs for bugcheck, unexpected shutdown, service-control, HTTP Service, IIS, and WinRM-related failures. Review Application logs, IIS logs, HTTPERR logs, reverse proxy logs, firewall logs, load balancer telemetry, and EDR process/service timelines for spikes in malformed HTTP requests, repeated connections from the same source, abrupt connection resets, 400/500-series response bursts, or service restarts. Correlate source IPs that generated unusual HTTP traffic immediately before crashes or service outages. Since no public exploit maturity or named threat actor activity is reported, treat findings as suspicious only when multiple signals align: exposed affected OS version, unpatched state, abnormal HTTP traffic, and temporally correlated service failure or host crash.

• HTTP.sys
• \\SystemRoot\\System32\\drivers\\HTTP.sys
• C:\\Windows\\System32\\drivers\\HTTP.sys
• C:\\Windows\\System32\\LogFiles\\HTTPERR\\httperr*.log
• httperr.log
• HTTPERR
• HTTP Service
• The HTTP service failed
• Event ID 1001
• BugCheck
• Event ID 6008
• The previous system shutdown was unexpected
• Event ID 7031
• Event ID 7034
• World Wide Web Publishing Service
• W3SVC
• Windows Remote Management
• WinRM
• w3wp.exe
• svchost.exe -k HTTPService
• C:\\inetpub\\logs\\LogFiles

What your security team should do

• Inventory all affected Windows 11 and Windows Server 2022/2025 systems, with special focus on internet-facing IIS, WinRM, and custom applications using the Windows HTTP Server API.
• Patch externally reachable and business-critical HTTP.sys-backed systems first using the applicable Microsoft cumulative security update.
• Restrict inbound access to HTTP.sys-backed services from untrusted networks until patching is complete.
• Monitor for unexplained IIS, HTTP.sys, WinRM, or system crashes, especially where preceded by unusual HTTP request patterns from the same source IPs.
• Add temporary detection rules for spikes in malformed HTTP requests, connection resets, 5xx responses, service restarts, and Windows bugcheck events on affected systems.
• Confirm high-availability and restart behavior for critical web services so a denial-of-service attempt does not create extended downtime.
• Track Microsoft advisories for exact fixed build numbers and any change in exploit maturity, KEV status, or evidence of in-the-wild exploitation.