CVE-2026-33096

Name of the Vulnerable Software and Affected Versions Windows HTTP.sys (affected versions not specified)

Description An out-of-bounds read flaw exists in the Windows HTTP.sys driver, a foundational networking component used by web servers and internal networking roles. An unauthenticated remote attacker can trigger a Denial of Service (DoS) condition by sending specially crafted network packets, which causes the targeted system to crash or become unstable. This issue occurs during kernel-mode HTTP processing.

Recommendations Install the latest April Microsoft security cumulative updates to patch the http.sys driver. Disable HTTP/3 support via the registry by modifying the EnableHttp3 and EnableAltSvc values.