CVE-2026-20929

An integer overflow or wraparound vulnerability in Windows HTTP.sys allows an unauthorized attacker to execute code remotely over a network.

Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

An out-of-bounds read in Windows HTTP.sys allows an authorized attacker to execute code locally.

Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.