Detections

Analysis of CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys

Windows HTTP.sys Malformed Range Header RCE (CVE-2026-47291)

sigma · generated; parse required before publication

title: Windows HTTP.sys Malformed Range Header RCE (CVE-2026-47291)
description: Detects crafted HTTP requests with anomalous Range headers exploiting
  integer overflow in HTTP.sys driver.
logsource:
  product: webserver
  service: iis
detection:
  selection:
    cs-method: GET
    sc-status: '416'
  condition: selection
level: medium
tags: []
references: []

EXPLOIT_Windows_HttpSys_IntegerOverflow

yara · compile required before publication

rule EXPLOIT_Windows_HttpSys_IntegerOverflow {
  strings:
    $s1 = "Range: bytes=0-18446744073709551615" ascii wide nocase
    $s2 = "HTTP_SYS_RCE_OVERFLOW_BYTE" ascii wide nocase
    $s3 = "W3SVC_KERNEL_CORRUPT" ascii wide nocase
  condition:
    any of them
}