CVE-2026-33096
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Published Apr 14, 2026 · updated Oct 14, 2026 · Microsoft Windows 11 version 23H2
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 14, 2026 · NIST NVD
Detected
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Oct 14, 2026 · NIST NVD
Updated
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
Affected
- cpe microsoft/windows 11 23h2version unspecified
- cpe microsoft/windows 11 24h2version unspecified
- cpe microsoft/windows 11 25h2version unspecified
- cpe microsoft/windows 11 26h1version unspecified
- vendor Microsoft Windows 11 Version 23H2version unspecified
- vendor Microsoft Windows 11 Version 24H2version unspecified
- vendor Microsoft Windows 11 Version 25H2version unspecified
- vendor Microsoft Windows 11 version 23H2version unspecified
- vendor Microsoft Windows 11 version 26H1version unspecified
- vendor Microsoft Windows Server 2022version unspecified
- vendor Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)version unspecified
- vendor Microsoft Windows Server 2025version unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-33096
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-33096
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-33096
30-day exploitation probability 1.2%
first.org - NIST NVDVulnerability recordCVE-2026-33096
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
nvd.nist.gov