Windows network stack vulnerabilities: RCE in HTTP.sys and address disclosure through NETIO.sys

Windows network stack vulnerabilities: RCE in HTTP.sys and address disclosure through NETIO.sys

ZDI and Cisco Talos researchers disclosed two bugs in Windows network stack drivers. Both reside in kernel mode, but give an attacker fundamentally different capabilities.

CVE-2026-47291 — RCE in HTTP.sys HTTP.sys receives and parses HTTP traffic for IIS and other Windows services. The vulnerability is caused by a 16-bit capacity counter for the input buffer array: when the value 0xFFFB is incremented by 5, it wraps around to zero. HTTP.sys allocates a buffer of approximately 40 bytes, then copies about 512 KB of data into it, causing kernel memory corruption. The attack uses tens of thousands of HTTP/1.x headers, each sent in a separate TLS record. Exploitation requires no authentication, but typically requires the MaxRequestBytes parameter to be increased to 262,144 bytes. The result may be a DoS or code execution in the kernel. The CVSS score is 9.8.

CVE-2026-50475 — memory disclosure in NETIO.sys NETIO.sys handles internal Windows network stack mechanisms and interacts with tcpip.sys, NDIS, NSI, and the Windows Filtering Platform. In the NsipGetAllInformationProviderParameters function, called by the IOCTL handler 0x120007, the user-controlled TableIndex is checked using the condition <= maxVtableIndex, although only smaller values are valid. This off-by-one error allows 16 bytes to be read beyond the table boundary. In the PoC, the leaked data included addresses within tcpip.sys, allowing the module's base address to be determined and KASLR to be bypassed. Exploitation requires a local low-privileged user. The CVSS score is 5.5.

Microsoft fixed CVE-2026-47291 in the security updates released on June 9, 2026, while CVE-2026-50475 was fixed in the updates released on July 14, 2026.

Article (on HTTP.sys): https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys

Article (on NETIO.sys): https://talosintelligence.com/vulnerability_reports/TALOS-2026-2443