What’s Vulnerable › Vulnerabilities

CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2022-02-10
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-04-14 · updated 2026-06-17
• Weakness: CWE-94

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Affected products

• Microsoft Windows 7: all versions
• Microsoft Windows 8: all versions
• Microsoft Windows 8.1: all versions
• Microsoft Windows Server 2008: r2-sp1
• Microsoft Windows Server 2012: r2

References

• http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
• http://www.osvdb.org/120629
• http://www.securityfocus.com/bid/74013
• http://www.securitytracker.com/id/1032109
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
• https://www.exploit-db.com/exploits/36773/
• https://www.exploit-db.com/exploits/36776/
• http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
• http://www.osvdb.org/120629
• http://www.securityfocus.com/bid/74013
• http://www.securitytracker.com/id/1032109
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034

Get alerted when CVE-2015-1635 or the next vulnerability affects your stack