Major HTTP Vulnerability in Windows Could Lead to Wormable Exploit

Microsoft disclosed CVE-2021-31166, a critical (CVSS 9.8) vulnerability in the HTTP.sys network stack that can cause an unauthenticated remote denial-of-service (BSoD) and may permit remote code execution. The issue affects Windows 10 and Windows Server 2004/20H2, has proof-of-impact potential and simple exploitability, but no confirmed in-the-wild exploitation was reported; the advisory urges immediate patching and McAfee published an IPS signature as a virtual patch.