A critical privilege escalation vulnerability in the Windows HTTP.sys driver allows an authenticated attacker to gain elevated system permissions.

This vulnerability involves an untrusted pointer dereference within the HTTP.sys kernel driver, which can be triggered by a locally authenticated user with low privileges to execute code with elevated system rights.

Successful exploitation of this flaw grants an attacker full control over the affected system, as it allows for the escalation of privileges to system level. Given the CVSS score of 7.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of sensitive enterprise assets, potentially facilitating further lateral movement within the network.

Immediate Action: Apply the latest security updates provided by Microsoft in the official update guide to address the vulnerable HTTP.sys driver.

Proactive Monitoring: Monitor system logs for unusual process creation or unauthorized attempts to interact with kernel-level drivers.

Compensating Controls: Ensure that user accounts are restricted to the principle of least privilege, which limits the ability of an attacker to perform the initial authentication required to trigger the exploit.

Public Exploit Available: Yes, an entry exists in ExploitDB.

Due to the severity of local privilege escalation and the presence of a public exploit, organizations must prioritize the deployment of the relevant Microsoft security patches across all affected Windows workstations and servers. Failure to remediate this vulnerability leaves systems exposed to potential full compromise by any user with local access.