CVE-2026-33096: 
vulnerability analysis and mitigation

CVE-2026-33096 is an out-of-bounds read vulnerability in Windows HTTP.sys that allows an unauthenticated, remote attacker to cause a denial of service over a network. It was disclosed and patched on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday security update cycle. Affected products include Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Microsoft MSRC, GitHub Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in Windows HTTP.sys, the kernel-mode HTTP request handler used by Windows web services. An attacker can send a specially crafted network request that causes HTTP.sys to read memory beyond the bounds of an allocated buffer, triggering a crash or unresponsive state. No authentication, privileges, or user interaction are required, and the attack can be launched remotely over a network with low complexity. The vulnerability was notably discovered through Microsoft's multi-model agentic AI security system, as referenced in a May 2026 Microsoft Security Blog post (Microsoft Security Blog).

Successful exploitation results in a denial of service condition, causing HTTP.sys to crash or become unresponsive, which directly impacts the availability of web services and any HTTP-dependent functionality on the affected system. Because HTTP.sys operates at the kernel level, a crash could affect the entire system's stability, not just individual web applications. There is no impact on confidentiality or data integrity, and no evidence of lateral movement potential beyond the availability disruption (Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Microsoft MSRC). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.17–0.19%, placing it in roughly the 41st percentile for exploitation likelihood within 30 days (GitHub Advisory). No threat actor attribution has been reported.

Microsoft released security patches on April 14, 2026, addressing this vulnerability across all affected platforms. Organizations should apply the following patched builds immediately:

• Windows 11 23H2: 10.0.22631.6936
• Windows 11 24H2: 10.0.26100.8246
• Windows 11 25H2: 10.0.26200.8246
• Windows 11 26H1: 10.0.28000.1836
• Windows Server 2022: 10.0.20348.5020
• Windows Server 2022 23H2: 10.0.25398.2274
• Windows Server 2025: 10.0.26100.32690

Prioritize patching production servers running HTTP.sys-dependent services (e.g., IIS, WinRM). No configuration-based workaround has been published; patching is the only recommended remediation (Microsoft MSRC).

The vulnerability was highlighted in multiple April 2026 Patch Tuesday roundups by security outlets including BleepingComputer, Qualys, Rapid7, and Zero Day Initiative, as part of coverage of the broader 167-flaw update release (BleepingComputer, Qualys Blog, Rapid7 Blog). Notably, Microsoft disclosed in May 2026 that this CVE was among 16 new vulnerabilities discovered by its multi-model agentic AI security system, drawing attention to AI-assisted vulnerability research (Microsoft Security Blog). Community reaction was moderate, with the vulnerability rated as significant due to its unauthenticated, network-exploitable nature, though the DoS-only impact limited urgency compared to RCE vulnerabilities in the same update.