HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote…

published 2015-04-14 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1765

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-02-10
epss: 100.0%; EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits: 4; Metasploit, Exploit-DB, plus a Nuclei check

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Patch / fix

cisa required action Apply updates per vendor instructions.

links 1

docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-17-215-02 updated 2017-08-03 cvss 9.8

ICSMA-17-215-02_Siemens Molecular Imaging Vulnerabilities

Siemens PET/CT Systems Windows 7-Based
affected: mitigation “In addition, Siemens recommends:”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2015-04-14 Published
2015-04-15 First public exploit (EDB-36773)
2022-02-10 Added to CISA KEV
2022-08-10 CISA patch deadline
2025-02-10 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-02-10)
Patch by: 2022-08-10 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Microsoft, HTTP.sys
CISA name: Microsoft HTTP.sys Remote Code Execution Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 20 mo ago (2025-02-10)

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/dos/http/ms15_034_ulonglongadd MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service metasploit auxiliary, normal rank
Metasploit auxiliary/scanner/http/ms15_034_http_sys_memory_dump MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure metasploit auxiliary, normal rank
EDB-36776 Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034) dos, 2015-04-16
EDB-36773 Microsoft Windows - 'HTTP.sys' (PoC) (MS15-034) dos, 2015-04-15
Nuclei template Microsoft Windows 'HTTP.sys' - Remote Code Execution nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

docs.microsoft.com /en-us/security-updates/securitybulletins/2015/ms15-034
vendor-advisory, patch
exploit-db.com /exploits/36773/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/36776/
exploit, third-party-advisory, vdb-entry
packetstormsecurity.com /files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
exploit, third-party-advisory, vdb-entry
osvdb.org /120629
vdb-entry, broken-link
securitytracker.com /id/1032109
vdb-entry, broken-link, third-party-advisory
securityfocus.com /bid/74013
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635
government-resource, us-government-resource

Sources

CVE List CVE-2015-1635
NVD CVE-2015-1635

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary