CVE-2026-33096

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 1.25%
EPSS Percentile: 69.24%
CISA KEV: Not listed

Description

Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Apr-2026 01:17
Last Modified: 15-Oct-2026 06:17
EPSS Date: 2026-10-28
CWE: CWE-125

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

Affected Products / Versions

microsoft / windows_11_23h2
Version / affected range: * · before (exclusive) 10.0.22631.6936
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_23h2
Version / affected range: * · before (exclusive) 10.0.22631.6936
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_24h2
Version / affected range: * · before (exclusive) 10.0.26100.8246
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_24h2
Version / affected range: * · before (exclusive) 10.0.26100.8246
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_25h2
Version / affected range: * · before (exclusive) 10.0.26200.8246
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_25h2
Version / affected range: * · before (exclusive) 10.0.26200.8246
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_26h1
Version / affected range: * · before (exclusive) 10.0.28000.1836
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
microsoft / windows_11_26h1
Version / affected range: * · before (exclusive) 10.0.28000.1836
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
microsoft / windows_server_2022
Version / affected range: * · before (exclusive) 10.0.20348.5020
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2022_23h2
Version / affected range: * · before (exclusive) 10.0.25398.2274
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
microsoft / windows_server_2025
Version / affected range: * · before (exclusive) 10.0.26100.32690
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 28-Oct-2026 21:52
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

an Android lock screen bypass, and a denial-of-service (DoS) flaw in the Windows HTTP.sys driver (CVE-2026-33096, CVSS score: 7.5). All the identified issues have been fixed by Google, Apple, and Microsoft. Google Debuts Gemini 4 Carbon With Strong Vulnerability-Finding and Patching Benchmark Scores
The public record for the bug it points to, CVE-2026-33096, instead names HTTP.sys, Windows' built-in web request handler, and rates it 7.5 out of 10. No open source ties those two descriptions together as the same Anthropic Says Unreleased AI Model Chained Flaws Into Working Exploits

CVE (1)

People (4)

Vendors (5)

Products (12)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.