Local privilege escalation via integer underflow

Integer underflow in Windows HTTP.sys in Microsoft Windows allows local authenticated users to gain elevated privileges via crafted input. Microsoft has disclosed only the bug class in the kernel HTTP listener; no public advisory, patch diff, or technical note identifies the affected routine or how underflowed arithmetic is consumed. Reachability is local with low privileges already required, and the published CVSS vector bounds the consequence to privilege escalation on the same host rather than remote code execution.