## https://sploitus.com/exploit?id=BF17F016-A03A-590E-BD55-4B068C703ADA
# CVE-2026-62735
## Information
- This vulnerability was originally discovered by Siyeon Wi. I reproduced the vulnerability independently for educational and case-study purposes. - The vulnerability was also demonstrated at Pwn2Own Berlin 2026. References:
- [TrendAI Zero Day Initiative status](https://x.com/thezdi/status/2055312455186723028)
- [TrendAI Zero Day Initiative blog](https://www.zerodayinitiative.com/advisories/ZDI-26-536/)
- Microsoft update details: [CVE-2026-62735](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62735)
- A PoC demonstrated a crash caused by the `Integer Overflow` vulnerability. With this vulnerability, we have a primitive `Heap Overflow` -> `SYSTEM shell` attack.
## Summary
- Vulnerability: `Integer Overflow`
- Component: `http.sys`
- Trigger function: `UlpCreateInternalResponseOld`
- Windows version: Windows 11 25H2 26200.8875
## Details
- The `Integer Overflow` vulnerability occurs when calculating the total number of header bytes. As a result, `http.sys` allocates memory based on `TotalHeaderBytes`, even though the headers require a much larger buffer. This leads to an overflow in the nonpaged-pool allocation in `UlGenerateMultipleKnownHeadersOld`:
```cpp
__int64 __fastcall UlpCreateInternalResponseOld(
sv_UL_REQUEST *Request,
unsigned __int16 EntityChunkCount,
unsigned int FixedHeaderCount,
unsigned int FixedHeaderBytes,
unsigned int MultipleHeaderCount,
unsigned int MultipleHeaderBytes,
unsigned __int16 KnownHeaderCount,
unsigned int TrailerCount,
unsigned int TrailerBytes,
char FastForwardRequested,
char CacheEligible,
char ResponseInfoPresent,
char AutomaticChunkingRequired,
char AdditionalHeaderRequired,
sv_UL_INTERNAL_RESPONSE **InternalResponseOut)
{
int VariableHeaderBytes; // r9d
int H3ExtraHeaderBytes; // r10d
unsigned int MultipleHeaderBytesLocal; // ecx
unsigned int TotalHeaderBytes; // [rsp+E8h] [rbp+60h]
... // 0xffffff32 + 0x2e + 0 + 0xa0 = 0x4e
TotalHeaderBytes = MultipleHeaderBytesLocal + FixedHeaderBytes + H3ExtraHeaderBytes + VariableHeaderBytes;
...
}
```
## Crash log
- Bugcheck:
```
*** Fatal System Error: 0x00000050
(0xFFFFCD86AE712000, 0x0000000000000002, 0xFFFFF807489C4362, 0x0000000000000002)
**Driver at fault:**
*** HTTP.SYS – Address FFFFF807489C4362, Base address: FFFFF80748860000; DateStamp: 2bfcaa4c
Break instruction exception – Code 80000003 (first chance)
A fatal system error has occurred. The debugger entered on the first attempt; BugCheck callbacks have not been invoked. A fatal system error has occurred. To analyze this file, run !analyze -v.
nt!DbgBreakPointWithStatus:
fffff807`b26fa0d0 cc int 3
**Stack trace:**
0: kd> k
# Child-SP RetAddr Call Site
00 ffffe205`092ddf78 fffff807`b27afcf2 nt!DbgBreakPointWithStatus
01 ffffe205`092ddf80 fffff807`b27af21e nt!KiBugCheckDebugBreak+0x12
02 ffffe205`092ddfe0 fffff807`b26f9357 nt!KeBugCheck2+0xb2e
03 ffffe205`092de770 fffff807`b24fd030 nt!KeBugCheckEx+0x107
04 ffffe205`092de7b0 fffff807`b2443c56 nt!MiSystemFault+0x850
05 ffffe205`092de8a0 fffff807`b28badcb nt!MmAccessFault+0x646
06 ffffe205`092dea10 fffff807`489c4362 nt!KiPageFault+0x38b
07 ffffe205`092deba8 fffff807`489a6611 HTTP!memcpy+0x122
08 ffffe205`092debb0 fffff807`4897c165 HTTP!UlGenerateMultipleKnownHeadersOld+0xbdd
09 ffffe205`092ded90 fffff807`48976db0 HTTP!UlpPrepareHttpResponseOld+0x2c9
0a ffffe205`092dee70 fffff807`489361a4 HTTP!UlCaptureHttpResponseOld+0x92c
0b ffffe205`092defc0 fffff807`488f7c92 HTTP!UlSendHttpResponseIoctlOld+0x1160
0c ffffe205`092df600 fffff807`488c4db5 HTTP!UlSendHttpResponseIoctl+0x12
0d ffffe205`092df630 fffff807`b245cabb HTTP!UxDeviceControl+0xb5
0e ffffe205`092df670 fffff807`b245ca33 nt!IopfCallDriver+0x5b
0f ffffe205`092df6b0 fffff807`b2ac0e75 nt!IofCallDriver+0x13
10 ffffe205`092df6e0 fffff807`b2abfcbc nt!IopSynchronousServiceTail+0x1c5
11 ffffe205`092df790 fffff807`b2abf30e nt!IopXxxControlFile+0x99c
12 ffffe205`092dfa00 fffff807`b28bf255 nt!NtDeviceIoControlFile+0x5e
13 ffffe205`092dfa70 00007ffa`d37c0144 nt!KiSystemServiceCopyEnd+0x25
14 00007ffa`d08a3953 ntdll!NtDeviceIoControlFile+0x14
15 00007ffa`d1f93335 KERNELBASE!DeviceIoControl+0x73
16 00007ff7`00cb1cb4 KERNEL32!DeviceIoControlImplementation+0x75
17 00007ff7`00cb1cb4 poc!
# Distribution Instructions (Chinese)
This repository serves as a distribution image for the PoC related to the **CVE-2026-62735** vulnerability (Windows HTTP.Sys integer overflow → non-pagable pool overflow → SYSTEM privilege escalation). Technical details can be found in the original README file from the upstream project. The content is derived from the publicly available PoC images and is used solely for archiving and distribution purposes. This PoC is intended only for security research, vulnerability validation, and authorized testing purposes. Do not use it for unauthorized targets.
## Vulnerability Summary
- **CVE-2026-62735** / Microsoft Windows HTTP.Sys privilege escalation
- **Discovered/Documented by**: Siyeon Wi (Pwn2Own Berlin 2026); This PoC was independently reproduced by **nhh9905**
- **Type**: Integer overflow (calculating the total number of header bytes → non-pagable pool overflow → SYSTEM privilege escalation)
- **CVSS 3.1**: MSRC **7.8** (Important)/ ZDI **8.8** (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- **Triggering Function**: `UlpCreateInternalResponseOld` / `UlGenerateMultipleKnownHeadersOld` (http.sys, old code path)
- **Target Version**: Windows 11 25H2 26200.8875 (public reproduction); Fixing version: Windows 11 25H2 **26200.9168**
- **Triggering Method**: A low-privilege local process creates an HTTP client and server, generating multiple HTTP response headers. These headers are processed by `IOCTL 0x12403F` (`UlSendHttpResponseIoctl`) via http.sys
- **Prerequisites**: The attacker must first execute low-privilege code on the target system (PR:L)
**Core Principle**: `TotalHeaderBytes = MultipleHeaderBytesLocal + FixedHeaderBytes + H3ExtraHeaderBytes + VariableHeaderBytes`. When the number of response headers approaches 2³², the 32-bit summation wraps to a very small value (`0xffffff32 + 0x2e + 0 + 0xa0 = 0x4e`). `ExAllocatePool3` allocates a kernel buffer that is much smaller than required, and then `UlGenerateMultipleKnownHeadersOld`'s `memcpy` overflows this non-pagable pool block.
## Directory Structure
```
poc/ poc.cpp + head.hpp —— Complete exploitation: Named pipe, DQE heap spray → Pool overflow control, 0x30 header → Arbitrary read/write → Copy SYSTEM token → SYSTEM shell
crash/ poc.cpp + head.hpp —— Only triggers crashes (verifies the existence of the vulnerability, triggers 0x50 bugcheck)
```
## Requirements & Usage
- **Target**: Windows 11 25H2 (near 26200.8875), unpatched version; Requires local execution privileges
- **Build**: poc.cpp requires Visual Studio (Windows) + Windows SDK, with HTTPAPI/WinHTTP dependencies
- Both `crash/` and `poc/` are independent executable files. Running `poc.exe` will spawn a SYSTEM shell
## Disclaimer
This PoC is intended only for teaching, security research, and authorized testing purposes. It should only be run on systems that own the exploit or have explicit authorization. Exploitation may lead to SYSTEM privilege escalation and potentially cause a blue screen (0x50). Please test in a destroyable virtual machine.
## Attribution & License
- **Vulnerability Discoverer**: **Siyeon Wi** (Pwn2Own Berlin 2026, ZDI Acknowledgements).
- **Author of this PoC**: **nhh9905** (Independently reproduced according to official announcements, including a complete SYSTEM exploitation chain).
- The distribution repository uses **MIT License** (see `LICENSE`).
## References
- Upstream PoC repository: https://github.com/nhh9905/CVE-2026-62735
- Researcher’s writeup (HackMD): https://hackmd.io/@nhh/Hy6Oem7_Me
- MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62735
- ZDI: https://www.zerodayinitiative.com/advisories/ZDI-26-536/