Windows HTTP Protocol Stack (HTTP.sys) Use-After-Free Remote Code Execution Vulnerability (CVE-2021-31166) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTHTTP.sys services running on Windows 10 versions 2004, 20H2 and Windows Server versions 2004, 20H2
Unauthenticated remote attackers can execute arbitrary code in the kernel context or trigger an immediate Blue Screen of Death (BSOD) leading to Denial of Service (DoS) by sending specially crafted HTTP packets
Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the latest Microsoft cumulative security updates. Use the following PowerShell commands to force-install the required updates.
# Install and import the Windows Update module to apply the security patch
Install-Module PSWindowsUpdate -Force -Verbose
Get-WindowsUpdate -KBArticleID KB5003173 -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict inbound HTTP/HTTPS traffic at the host firewall level to trusted IP addresses only.
# Block external HTTP and HTTPS traffic using Windows Defender Firewall
New-NetFirewallRule -DisplayName 'Block External HTTP' -Direction Inbound -Action Block -Protocol TCP -LocalPort 80
New-NetFirewallRule -DisplayName 'Block External HTTPS' -Direction Inbound -Action Block -Protocol TCP -LocalPort 4433. Log Audit & IoC Verification Commands
Verify the current Windows OS build version to determine vulnerability status, and inspect the system event logs for HTTP.sys-related crashes.
# Retrieve OS version and build details
Get-WmiObject Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber
# Query system event logs for BSOD events related to HTTP.sys
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -ErrorAction SilentlyContinue | Where-Object {$_.Message -like '*http.sys*'}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a Use-After-Free (UAF) flaw (CWE-416) residing in the Windows kernel-mode driver HTTP.sys (the HTTP Protocol Stack). The root cause lies in the improper reference counting of internal memory objects when HTTP.sys parses complex or multi-valued HTTP request headers, such as the 'Accept-Encoding' header. This allows an attacker to trigger a condition where the driver attempts to access memory that has already been freed.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can exploit this vulnerability remotely over the network without any user interaction. Publicly available Proof-of-Concept (PoC) exploits demonstrate that sending a crafted HTTP request containing malformed or redundant identifiers within the 'Accept-Encoding' header causes the HTTP.sys driver to dereference a freed memory pointer. This immediately triggers a kernel panic, resulting in a Blue Screen of Death (BSOD). Due to its self-replicating potential, this vulnerability is classified as wormable.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability poses a critical threat to enterprise infrastructure. It is listed in the CISA KEV catalog, confirming active exploitation in the wild, and carries an EPSS score of 0.9987, indicating an extremely high probability of exploitation. Any exposed IIS web servers or WinRM endpoints running on vulnerable Windows versions are highly susceptible to complete system compromise or persistent denial of service.
Official Vendor Advisories & References
HTTP Protocol Stack Remote Code Execution Vulnerability
Frequently Asked SecOps Questions (CVE-2021-31166)
FAQQ1. How critical is CVE-2021-31166 and is it actively exploited in the wild?
CVE-2021-31166 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-31166?
Primary impacted vendors include microsoft across windows_10, windows_server. Scope summary: Windows 10 (versions 2004, 20H2) and Windows Server (versions 2004, 20H2)
Q3. What temporary mitigations or workarounds exist for CVE-2021-31166 before patching?
[Mitigation] Apply the official Microsoft cumulative security updates immediately, and restrict external exposure of HTTP.sys-dependent services prior to patching Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-31166
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows AFD.sys Use-After-Free Local Privilege Escalation Vulnerability (CVE-2026-68820) Security Advisory
[Affected Scope] Systems running Microsoft Windows operating systems utilizing the Ancillary Function Driver for WinSock (afd.sys)
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.