CVE-2026-21250

HIGH

Windows HTTP.sys - Privilege Escalation

Title source: llm

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

CVSS v3 7.8

EPSS 0.0002

EPSS Percentile 5.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-822

Status published

microsoft/windows_11_24h2 < 10.0.26100.7781

microsoft/windows_11_25h2 < 10.0.26200.7781

microsoft/windows_server_2022_23h2 < 10.0.25398.2149

microsoft/windows_server_2025 < 10.0.26100.32313

Published Feb 10, 2026

Tracked Since Feb 18, 2026