This vulnerability involves an out-of-bounds read in the Windows HTTP.sys driver on Windows 11 Version 24H2 (build 10.0.26100.0). An unauthorized attacker with local access can exploit this flaw to read memory outside the intended buffer boundaries, potentially disclosing sensitive information. The vulnerability is tracked as CWE-125 and has a CVSS 3.1 base score of 6.2, indicating a medium severity. Microsoft has released an official patch to remediate this issue.

Successful exploitation of this vulnerability allows an unauthorized local attacker to read memory beyond allocated bounds in the HTTP.sys component, leading to potential disclosure of sensitive information. There is no impact on integrity or availability reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 11 Version 24H2 to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50420 for detailed patch information and deployment instructions.