pwned.coffeeUpdated 44 min ago

Past orders

A past order. It may still matter if you haven't patched.

pwned.coffeeOrder ticket · past order · 27 Oct 2026

Double espresso · 355°CcriticalOrder up · fix available

Windows: memory corruption

Windows

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

Fix it

Windows 10 Version 1607

  • Upgrade to Windows 10 Version 1607 10.0.14393.9234

Windows 10 Version 1809

  • Upgrade to Windows 10 Version 1809 10.0.17763.8880

Windows 10 Version 21H2

  • Upgrade to Windows 10 Version 21H2 10.0.19044.7417

Windows 10 Version 22H2

  • Upgrade to Windows 10 Version 22H2 10.0.19045.7417

Windows 11 version 23H2

  • Upgrade to Windows 11 version 23H2 10.0.22631.7219

Windows 11 Version 24H2

  • Upgrade to Windows 11 Version 24H2 10.0.26100.8655

Windows 11 Version 25H2

  • Upgrade to Windows 11 Version 25H2 10.0.26200.8655

Windows 11 version 26H1

  • Upgrade to Windows 11 version 26H1 10.0.28000.2269

Windows Server 2012

  • Upgrade to Windows Server 2012 6.2.9200.26132

Windows Server 2012 (Server Core installation)

  • Upgrade to Windows Server 2012 (Server Core installation) 6.2.9200.26132

Windows Server 2012 R2

  • Upgrade to Windows Server 2012 R2 6.3.9600.23228

Windows Server 2012 R2 (Server Core installation)

  • Upgrade to Windows Server 2012 R2 (Server Core installation) 6.3.9600.23228

Windows Server 2016

  • Upgrade to Windows Server 2016 10.0.14393.9234

Windows Server 2016 (Server Core installation)

  • Upgrade to Windows Server 2016 (Server Core installation) 10.0.14393.9234

Windows Server 2019

  • Upgrade to Windows Server 2019 10.0.17763.8880

Windows Server 2019 (Server Core installation)

  • Upgrade to Windows Server 2019 (Server Core installation) 10.0.17763.8880

Windows Server 2022

  • Upgrade to Windows Server 2022 10.0.20348.5256

Windows Server 2025

  • Upgrade to Windows Server 2025 10.0.26100.32995

Windows Server 2025 (Server Core installation)

  • Upgrade to Windows Server 2025 (Server Core installation) 10.0.26100.32995
First seen
Last update
Fixed in
  • Windows 10 Version 1607 10.0.14393.9234
  • Windows 10 Version 1809 10.0.17763.8880
  • Windows 10 Version 21H2 10.0.19044.7417
  • Windows 10 Version 22H2 10.0.19045.7417
  • Windows 11 version 23H2 10.0.22631.7219
  • Windows 11 Version 24H2 10.0.26100.8655
  • Windows 11 Version 25H2 10.0.26200.8655
  • Windows 11 version 26H1 10.0.28000.2269
  • Windows Server 2012 6.2.9200.26132
  • Windows Server 2012 R2 6.3.9600.23228
  • Windows Server 2022 10.0.20348.5256
  • Windows Server 2025 10.0.26100.32995
Identifiers
CVSS
9.8
Source
news
On the menu as

Timeline

  1. Fix status: unknown → patched.

  2. First reported.

Receipt

Exploitation
No known exploitation
Fix by release line
ProductAffectedFixed inSource
Windows 10 Version 160710.0.14393.0 to before 10.0.14393.923410.0.14393.9234CVE record (CNA) checked
Windows 10 Version 180910.0.17763.0 to before 10.0.17763.888010.0.17763.8880CVE record (CNA) checked
Windows 10 Version 21H210.0.19044.0 to before 10.0.19044.741710.0.19044.7417CVE record (CNA) checked
Windows 10 Version 22H210.0.19045.0 to before 10.0.19045.741710.0.19045.7417CVE record (CNA) checked
Windows 11 version 23H210.0.22631.0 to before 10.0.22631.721910.0.22631.7219CVE record (CNA) checked
Windows 11 Version 24H210.0.26100.0 to before 10.0.26100.865510.0.26100.8655CVE record (CNA) checked
Windows 11 Version 25H210.0.26200.0 to before 10.0.26200.865510.0.26200.8655CVE record (CNA) checked
Windows 11 version 26H110.0.28000.0 to before 10.0.28000.226910.0.28000.2269CVE record (CNA) checked
Windows Server 20126.2.9200.0 to before 6.2.9200.261326.2.9200.26132CVE record (CNA) checked
Windows Server 2012 (Server Core installation)6.2.9200.0 to before 6.2.9200.261326.2.9200.26132CVE record (CNA) checked
Windows Server 2012 R26.3.9600.0 to before 6.3.9600.232286.3.9600.23228CVE record (CNA) checked
Windows Server 2012 R2 (Server Core installation)6.3.9600.0 to before 6.3.9600.232286.3.9600.23228CVE record (CNA) checked
Score
CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA microsoft) for CVE-2026-47291
Last checked

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee