Skip to content
Vulnerability intelligence

CVE-2026-47291

HTTP.sys is the kernel-mode HTTP driver that underlies IIS, WCF, WinRM, ASP.NET, and every Windows web service. A specially crafted request exceeding 65,535 bytes triggers an integer overflow, heap buffer overflow, and arbitrary code execution with kernel privileges. No authentication. No user interaction. One HTTP request.

2026
What WebPulse reported · 3 analyses
CVE-2026-47291: The Invisible Layer Under Every Windows Web Server Just Got a CVSS 9.8.

HTTP.sys is the kernel-mode HTTP driver that underlies IIS, WCF, WinRM, ASP.NET, and every Windows web service. A specially crafted request exceeding 65,535 byt

June 20, 2026
Chrome Zero-Day CVE-2026-11645 Actively Exploited: The Browser Is the New Server

Out-of-bounds memory access in Chrome's V8 engine is being exploited in the wild. CVSS 8.8. When the browser is the runtime, browser vulnerabilities are applica

June 18, 2026
208 CVEs in One Patch Tuesday. Microsoft's Largest Ever. Including a Wormable Kernel Flaw Compared to EternalBlue. Your Web Server Has 72 Hours.

June 2026 Patch Tuesday delivered 208 CVEs (571 with Chromium bundled), 37 Critical. CVE-2026-45657 (CVSS 9.8) is a use-after-free in Windows Kernel TCP/IP that

June 16, 2026
View CVE-2026-47291 on the NIST National Vulnerability Database →
Related vulnerabilities
CVE-2026-9082 CVE-2026-8206 CVE-2026-48019 CVE-2026-35273 CVE-2026-11645 CVE-2026-8181 CVE-2026-45657 CVE-2026-3844