CVE-2024-26219: 
vulnerability analysis and mitigation

CVE-2024-26219 is a Denial of Service vulnerability affecting HTTP.sys in Microsoft Windows systems. The vulnerability was initially disclosed on April 9, 2024, and received a CVSS v3.1 base score of 7.5 (HIGH) (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that affects the HTTP.sys component in Microsoft Windows. It has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it can be exploited remotely with low attack complexity, requires no privileges or user interaction, and can result in high availability impact (NVD).

The vulnerability can lead to a denial of service condition, potentially affecting the availability of affected Windows systems. The high availability impact score in the CVSS rating indicates that successful exploitation could result in a significant disruption of system services (Rapid7).

The vulnerability can be exploited remotely with low attack complexity and requires no special privileges or user interaction, as indicated by the CVSS vector string (AV:N/AC:L/PR:N/UI:N) (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB5036896 for Windows 10 1809, KB5036892 for Windows 10 21H2/22H2, KB5036894 for Windows 11 21H2, KB5036893 for Windows 11 22H2/23H2, and KB5036909/KB5036910 for Windows Server 2022 (Rapid7).