CVE-2026-21240
published 2026-02-10CVE-2026-21240: Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1809 | < 10.0.17763.8389 | 10.0.17763.8389 |
| microsoft | windows_10_21h2 | < 10.0.19044.6937 | 10.0.19044.6937 |
| microsoft | windows_10_22h2 | < 10.0.19045.6937 | 10.0.19045.6937 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.8389 | 10.0.17763.8389 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6937 | 10.0.19044.6937 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6937 | 10.0.19045.6937 |
| microsoft | windows_11_23h2 | < 10.0.22631.6649 | 10.0.22631.6649 |
| microsoft | windows_11_24h2 | < 10.0.26100.7781 | 10.0.26100.7781 |
| microsoft | windows_11_25h2 | < 10.0.26200.7781 | 10.0.26200.7781 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.6649 | 10.0.22631.6649 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.6649 | 10.0.22631.6649 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.7840 | 10.0.26100.7840 |
| microsoft | windows_11_version_25h2 | >= 10.0.26200.0 < 10.0.26200.7840 | 10.0.26200.7840 |
| microsoft | windows_11_version_26h1 | >= 10.0.28000.0 < 10.0.28000.1575 | 10.0.28000.1575 |
| microsoft | windows_server_2019 | < 10.0.17763.8389 | 10.0.17763.8389 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.8389 | 10.0.17763.8389 |
| microsoft | windows_server_2022 | < 10.0.20348.4711 | 10.0.20348.4711 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.4773 | 10.0.20348.4773 |
| microsoft | windows_server_2022_23h2 | < 10.0.25398.2149 | 10.0.25398.2149 |
| microsoft | windows_server_2025 | < 10.0.26100.32313 | 10.0.26100.32313 |
| microsoft | windows_server_2025 | >= 10.0.26100.0 < 10.0.26100.32370 | 10.0.26100.32370 |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_21h2 | — | — |
| msrc | windows_10_version_22h2 | — | — |
| msrc | windows_11_version_23h2 | — | — |