Description

Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:20:25.073Z",
  "pubdate": "2026-09-08T18:20:25.073Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the Windows Internet Connection Sharing (ICS) service, a component responsible for managing network address translation and network configuration sharing across Windows hosts.\nThis vulnerability is classified as a memory corruption flaw that occurs when the service improperly manages the lifecycle of memory objects, leading to a dangling pointer reference.\nSuccessful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution on the target system by manipulating memory heap states.\nGiven that the ICS service typically operates with elevated system-level privileges, successful exploitation grants the attacker full control over the compromised host, facilitating lateral movement within the network or complete system compromise.\nThe vulnerability poses a severe risk to organizational security, as it does not require user interaction or pre-existing credentials, making it an ideal target for wormable network-based attacks.\nThe exposure is limited to systems where the Internet Connection Sharing service is enabled, necessitating immediate risk assessment and implementation of defensive controls.",
  "technicalDetails": "The vulnerability originates from improper memory management within the Windows Internet Connection Sharing (ICS) service. A use-after-free (UAF) condition is triggered when the service prematurely deallocates a memory object associated with network connection handling, while maintaining a stale pointer (dangling pointer) that still references the deallocated memory region.\nUnder specific conditions, an attacker can trigger this state by sending crafted network packets to the target system. These packets are designed to force the ICS service to allocate and subsequently free a specific object. By meticulously timing subsequent operations, the attacker can manipulate the heap state to allocate a new object of controlled size and content at the exact memory address previously occupied by the freed object.\nWhen the ICS service attempts to utilize the original, now-dangling pointer, it inadvertently operates on the attacker-controlled data. This leads to an type-confusion scenario or, more directly, the invocation of function pointers stored within the attacker-controlled memory block.\nThe exploitation flow typically follows these steps: 1) The attacker transmits a sequence of malformed network requests designed to instantiate a specific object within the ICS service memory. 2) The attacker triggers an internal state change that causes the service to free the object while leaving a reference to it in an active memory cache or queue. 3) The attacker performs heap grooming by sending additional packets that force the allocator to reuse the freed memory block for a new object, injecting arbitrary data into that space. 4) The attacker invokes a function within the service that references the dangling pointer, redirecting the execution flow to an attacker-specified address or a ROP (Return-Oriented Programming) chain.\nBecause the ICS service functions as a high-integrity process, the malicious code executes with SYSTEM privileges. This level of access bypasses typical user-mode security boundaries and enables the attacker to install persistence mechanisms, disable security software, or exfiltrate sensitive data from the local kernel or user space.\nThis vulnerability is strictly network-reachable, as the ICS service listens for incoming packets to facilitate connection management, providing an attack vector that does not necessitate local access or the presence of a logged-in user."
}