CVE-2026-21240

Name of the Vulnerable Software and Affected Versions Windows HTTP.sys (affected versions not specified)

Description A time-of-check time-of-use (TOCTOU) race condition exists in Windows HTTP.sys. This condition can be exploited by an authorized attacker to gain elevated privileges on a local system. The issue involves a flaw in how the system verifies conditions between the time a check is performed and the time the result of that check is used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.