This vulnerability (CVE-2026-33096) involves an out-of-bounds read (CWE-125) in the Windows HTTP.sys driver on Windows 11 version 22H3. An attacker without privileges and without user interaction can exploit this flaw remotely over the network to trigger a denial of service condition. The CVSS v3.1 base score is 7.5, reflecting high severity due to network attack vector, no required privileges or user interaction, and impact limited to availability. Microsoft has published an official patch to remediate this issue.

Successful exploitation results in denial of service by causing the affected system's HTTP.sys component to read memory outside of its intended bounds, potentially leading to system instability or crash. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096 to remediate this vulnerability. No additional mitigations are indicated by the vendor advisory.