Loading story…
Microsoft patched CVE-2026-47291, a remotely exploitable flaw in Windows HTTP.sys that can cause denial of service or potentially kernel-level remote code execution on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an integer overflow while HTTP.sys expands a per-request buffer reference array during HTTP/1.x header parsing over TLS; the array's 16-bit capacity can wrap to zero, leading to a large kernel pool heap buffer overflow during memory movement operations.
Exploitation requires a remote, unauthenticated attacker to send a specially crafted HTTPS request with many header lines, placing each header in a separate TLS application data record so each becomes a distinct buffer reference. The issue is described as reachable only on the HTTP/1.x over TLS path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the MaxRequestBytes registry setting at or below 65,535 bytes is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft fixed CVE-2026-47291, a remotely exploitable Windows HTTP.sys vulnerability, in its June 2026 release cycle. The patch is described as the recommended remediation for the issue.
Zero Day Initiative published a technical analysis of CVE-2026-47291, describing an integer overflow in Windows HTTP.sys during HTTP/1.x header parsing over TLS that can lead to kernel pool heap overflow, denial of service, or possible kernel-level remote code execution. The write-up explained exploitation conditions, including crafted header lines in separate TLS records and dependence on MaxRequestBytes configuration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-49160**, an Important denial-of-service flaw in **HTTP.sys** that stems from uncontrolled resource consumption during **HTTP/2** processing. The vulnerability can be triggered remotely by an unauthenticated attacker with no user interaction, allowing service disruption over the network, and Microsoft assigned it a **CVSS 3.1 score of 7.5**. The company said the issue had been **publicly disclosed** but had **not been exploited** at publication, while rating exploitation as more likely. Microsoft said the fix is included in the June 2026 Windows security updates and introduced a new registry setting, **`MaxHeadersCount`**, to limit the number of headers accepted in **HTTP/2** and **HTTP/3** requests handled by the Windows HTTP server. According to Microsoft support guidance, administrators can configure the **`REG_DWORD`** value under HTTP service parameters after installing the update; the default is **200**, with a minimum of **50** and a maximum of **65535**, and a system restart is required for changes to take effect. Microsoft said the control is intended to reduce excessive memory use, high CPU consumption, and denial-of-service conditions, and noted that **`MaxRequestBytes`** may still impose a higher effective header limit in some cases.
Jun 29, 2026
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026