Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-21250. PoCs published by 3302509675, kaleth4.
AI-analyzed exploit summary This exploit targets a local privilege escalation vulnerability in Windows 11 24H2 and Windows Server 2022 23H2 by sending a maliciously crafted HTTP request to trigger a BSOD via HTTP.sys. The code includes a critical flaw in the `strcat` function that truncates the malicious pointer, which may prevent successful exploitation.
Description
Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
Exploits (2)
This exploit targets a local privilege escalation vulnerability in Windows 11 24H2 and Windows Server 2022 23H2 by sending a maliciously crafted HTTP request to trigger a BSOD via HTTP.sys. The code includes a critical flaw in the `strcat` function that truncates the malicious pointer, which may prevent successful exploitation.
The repository contains functional exploit code for CVE-2026-21250, a local privilege escalation vulnerability in Windows HTTP.sys. The exploit sends a crafted HTTP request with a malicious pointer to trigger an untrusted pointer dereference, potentially leading to SYSTEM privileges.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H