This vulnerability (CVE-2026-49787) affects Windows 10 Version 1607 (build 10.0.14393.0) and is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The flaw exists in the HTTP.sys component, which handles HTTP requests at the kernel level. Due to lack of proper resource allocation limits, an attacker can send crafted network requests to exhaust resources, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity), indicating network attack vector, low complexity, no privileges or user interaction required, and impacts availability only. Microsoft has published an official fix to remediate this issue.

Successful exploitation allows an unauthenticated attacker to cause a denial of service condition by exhausting system resources via HTTP.sys, impacting system availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49787 to remediate this vulnerability.