This vulnerability (CVE-2026-33096) involves an out-of-bounds read condition in the Windows HTTP.sys driver on Windows 11 version 22H3. An attacker without privileges or user interaction can send specially crafted network requests that trigger the vulnerability, resulting in denial of service by crashing or destabilizing the affected system. The CVSS v3.1 base score is 7.5, reflecting network attack vector, no required privileges or user interaction, and high impact on availability. Microsoft has published an official fix to remediate this issue.

Successful exploitation of this vulnerability allows an unauthenticated attacker to cause a denial of service on affected Windows 11 version 22H3 systems by triggering an out-of-bounds read in HTTP.sys. This results in service disruption and potential system instability. There is no impact on confidentiality or integrity reported. No known active exploits have been observed.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096 to remediate this vulnerability. No additional mitigation steps are required once the patch is applied.