{"id":"CVE-2026-95923","kind":"vulnerability","aliases":["CVE-2026-95923"],"related":[],"title":"Windows HTTP.sys: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows HTTP.sys driver lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger or a public exploit.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http.sys","iis","infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users","patched-windows"],"how_to_check":"unknown: the MSRC entry for CVE-2026-95923 was not readable. Once it is, compare the build number of C:\\Windows\\System32\\drivers\\http.sys against the patched build listed there.","fix":null,"status":"open","published_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:49:50+00:00","updated_at":"2026-11-10T20:25:06+00:00","category":"infrastructure","confidence":0.2,"triage":{"at":"2026-11-10T19:49:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows HTTP.sys: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows HTTP.sys driver lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger or a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","http.sys","iis","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95923 for affected Windows builds, the patched KB, and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users","patched-windows"],"who_is_affected":"Windows machines that run HTTP.sys, which includes most Windows servers and any host using IIS or other HTTP.sys-based services. The attacker must already have an authorized local account, so shared hosts and multi-user servers carry the most risk. The sources do not say which Windows versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4496,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95923 for affected Windows builds, the patched KB, and any mitigation.","search":"'-2026':13A,16A '-95923':14A,17A 'account':44B 'allow':68C 'alreadi':40B 'attack':38B,71C 'author':70C 'base':28B,62C 'buffer':29B,63C 'cve':12A,15A 'describ':52B 'driver':35B 'elev':73C 'exploit':59B 'gain':9A 'heap':3A,27B,61C 'heap-bas':26B,60C 'higher':10A 'host':23B 'http.sys':2A,18B,34B,67C 'ii':19B 'infrastructur':20B 'let':5A,36B 'local':7A,43B,75C 'overflow':4A,30B,64C 'privileg':11A,47B,74C 'public':58B 'rais':45B 'remot':54B 'self':22B 'self-host':21B 'sourc':49B 'trigger':55B 'user':8A 'window':1A,24B,33B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that run HTTP.sys, which includes most Windows servers and any host using IIS or other HTTP.sys-based services. The attacker must already have an authorized local account, so shared hosts and multi-user servers carry the most risk. The sources do not say which Windows versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","httpsys","iis","infrastructure","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95923':14A,17A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'http.sys':2A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'account':44B 'alreadi':40B 'attack':38B 'base':28B 'buffer':29B 'describ':52B 'driver':35B 'exploit':59B 'heap':27B 'heap-bas':26B 'host':23B 'http.sys':18B,34B 'ii':19B 'infrastructur':20B 'let':36B 'local':43B 'overflow':30B 'privileg':47B 'public':58B 'rais':45B 'remot':54B 'self':22B 'self-host':21B 'sourc':49B 'trigger':55B 'window':24B,33B","search_c":"'allow':68C 'attack':71C 'author':70C 'base':62C 'buffer':63C 'elev':73C 'heap':61C 'heap-bas':60C 'http.sys':67C 'local':75C 'overflow':64C 'privileg':74C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95923","severity":null,"published_at":"2026-11-10T19:21:45+00:00","modified_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95923:2654","url":null,"severity":null,"published_at":"2026-11-10T20:25:06+00:00","modified_at":"2026-11-10T20:25:06+00:00","first_seen_at":"2026-11-10T20:25:06+00:00","fetched_at":"2026-11-10T20:25:06+00:00","note":"Could not read the MSRC entry (page returned empty) and searches found no other source for this CVE. Affected builds, KB and mitigations are unknown. The HTTP.sys results returned were for other CVEs (e.g. CVE-2026-47291) and were not used. Needs a revisit once MSRC or NVD text loads."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}