This vulnerability (CVE-2026-21232) is classified as CWE-822: Untrusted Pointer Dereference, occurring in the Windows HTTP.sys driver on Windows 11 version 22H3 (build 10.0.22631.0). An authorized local attacker can exploit this flaw to elevate privileges, potentially gaining higher system rights than intended. The CVSS v3.1 base score is 7.8, reflecting local attack vector with low complexity, requiring privileges but no user interaction, and resulting in high impact to confidentiality, integrity, and availability. Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected Windows 11 system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. No public exploits are currently known.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21232 to remediate this vulnerability. No additional mitigation actions are indicated by the vendor.