Privilege escalation via HTTP.sys heap overflow

Heap-based buffer overflow in Windows HTTP.sys in Microsoft Windows allows local users to gain SYSTEM privileges via unspecified vectors. Microsoft has disclosed only that HTTP.sys mishandles attacker-controlled input with a heap overflow; the affected request path or unsafe memory operation has not been published in the CNA or vendor advisory. Exploitation requires local low-privilege code execution or a comparable authenticated foothold on a vulnerable Windows host, and public sources describe privilege escalation rather than a direct remote compromise path.