Description

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T17:18:40.170Z",
  "pubdate": "2026-08-11T17:18:40.170Z",
  "executiveSummary": "A double free vulnerability exists within the Windows Secure Socket Tunneling Protocol (SSTP), posing severe security risks to affected systems. This memory corruption flaw allows an unauthorized remote attacker to execute arbitrary code over a network without requiring any prior authentication or user interaction. The vulnerability resides in the core handling of SSTP packet processing within the Windows operating system. Successful exploitation of this flaw can lead to complete system compromise, enabling the threat actor to execute commands with the privileges of the vulnerable service. The risk implications are critical, as the attack vector is network-accessible and can be weaponized by unauthenticated entities against target infrastructure. Given the severity of remote code execution vulnerabilities in core tunneling protocols, immediate remediation and monitoring are essential to prevent exploitation.",
  "technicalDetails": "The vulnerability is classified as a double free memory corruption flaw, occurring within the Secure Socket Tunneling Protocol (SSTP) component of the Windows operating system. A double free condition arises when the application dynamically allocates memory, releases the same memory allocation twice via memory management routines, and subsequently corrupts the internal heap management structures. This typically happens due to improper state tracking and error-handling logic during the parsing and processing of maliciously crafted SSTP network packets.\nThe attack flow begins when an unauthenticated attacker sends specially crafted SSTP packets over the network to a target Windows system running the vulnerable SSTP service. As the parsing routines process the malformed input, specific execution paths trigger an erroneous secondary deallocation of a previously freed heap chunk. This manipulation corrupts adjacent heap metadata, allowing the attacker to manipulate subsequent memory allocations and pointer references.\nBy carefully engineering the heap layout prior to triggering the double free condition, an advanced attacker can achieve arbitrary write or read primitives. This memory manipulation ultimately facilitates remote code execution within the context of the affected service process. The vulnerable component is exposed over the network, requires zero authentication, and can be exploited by any unauthorized attacker capable of reaching the SSTP listener on the target system. Post-exploitation impact includes full system compromise, lateral movement within the enterprise network, and deployment of malicious payloads."
}