Description
A remote code execution vulnerability exists in the HTTP protocol stack (HTTP.sys) that is caused when HTTP.sys improperly parses specially crafted HTTP requests. An attacker who successfully exploited this vulnerability could execute arbitrary code in the context of the System account.
This security update is rated Critical for all supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2.
Remediation
Microsoft has provided a security update for this issue. It's recommended to apply this update as soon as possible.
References
Related Vulnerabilities
HipChat for JIRA plugin - Velocity template injection
Oracle Access Manager 'opensso' Deserialization RCE (CVE-2021-35587)
Ektron CMS unauthenticated code execution and Local File Read
Sitecore XM/XP Insecure Deserialization (CVE-2025-27218)
WordPress 2.1.1 Command Execution Backdoor Vulnerability (2.1.1)