Millions at Risk: 9.8 CVSS Remote Code Execution in HTTP.sys

This advisory warns of a critical HTTP.sys RCE (CVE-2026-47291, CVSS 9.8) caused by an integer overflow/wraparound that could allow remote code execution. Microsoft reports no public exploits yet but considers reliable exploit code likely; the report urges immediate installation of June 2026 security updates and offers a temporary mitigation by adjusting the MaxRequestBytes registry value (with restart) and instructions to revert after patching.