Microsoft Windows HTTP.sys Elevation of Privilege Vulnerability Exploit (CVE-2026-62735)

Windows HTTP.sys is vulnerable to an integer overflow while calculating the size required for HTTP response headers. The resulting undersized nonpaged-pool allocation can be overflowed while HTTP.sys generates the response headers, producing a heap-based buffer overflow. This module executes an exploit binary in memory. The exploit uses the memory corruption to build arbitrary kernel read and write primitives, then replaces the current agent process token with the SYSTEM process token. The steps performed by the exploit are: Prepare a local HTTP server and a crafted HTTP response Spray named-pipe data queue entries in the nonpaged pool Trigger the integer overflow and corrupt an adjacent data queue entry Build arbitrary kernel read and write primitives Locate the current agent and SYSTEM process objects Copy the SYSTEM process token to the current agent process