CVE-2015-1635
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and...
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Exploit likelihood
What each source reports
CVE List
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- Record
CVE-2015-1635- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2015-1765
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- Record
EUVD-2015-1765- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p8wc-6g47-vh8j
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and...
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- Record
GHSA-p8wc-6g47-vh8j- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Microsoft HTTP.sys Remote Code Execution Vulnerability
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
- Record
CVE-2015-1635- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- Record
CVE-2015-1635- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Windows - 'HTTP.sys' (PoC) (MS15-034) | 2015-04-15 |
| Exploit-DB | Microsoft Windows - 'HTTP.sys' HTTP Request Parsing Denial of Service (MS15-034) | 2015-04-16 |
| PoC in GitHub | Zx7ffa4512-Python/Project-CVE-2015-1635 | 2015-04-16 |
| PoC in GitHub | technion/erlvulnscan | 2015-05-04 |
| PoC in GitHub | hedgecore/HTTPsys | 2015-05-05 |
| PoC in GitHub | wiredaem0n/chk-ms15-034 | 2015-10-14 |
| PoC in GitHub | u0pattern/Remove-IIS-RIIS | 2017-01-28 |
| PoC in GitHub | bongbongco/MS15-034 | 2017-06-29 |
| PoC in GitHub | aedoo/CVE-2015-1635-POC | 2018-06-20 |
| PoC in GitHub | h3x0v3rl0rd/CVE-2015-1635 | 2021-07-12 |
Show 8 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | h3x0v3rl0rd/CVE-2015-1635-POC | 2021-07-12 |
| PoC in GitHub | w01ke/CVE-2015-1635-POC | 2022-04-17 |
| PoC in GitHub | SkinAir/ms15-034-Scan | 2022-04-19 |
| PoC in GitHub | Cappricio-Securities/CVE-2015-1635 | 2024-05-28 |
| PoC in GitHub | moeinmiadi/CVE-2015-1635_PoC | 2025-10-20 |
| Nuclei | Microsoft Windows 'HTTP.sys' - Remote Code Execution | |
| Metasploit | MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service | |
| Metasploit | MS15-034 HTTP Protocol Stack Request Handling HTTP.SYS Memory Information Disclosure |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1635 is a high vulnerability (CVSS 10.0) in Microsoft Http.sys, published April 14, 2015. CISA lists it as known to be exploited, since February 10, 2022. EUVD reports exploitation since February 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.