Description

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:20:29.810Z",
  "pubdate": "2026-09-08T18:20:29.810Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Windows Secure Socket Tunneling Protocol (SSTP) implementation. This memory corruption flaw allows a remote, unauthenticated attacker to execute arbitrary code with elevated privileges by sending specially crafted packets to the target system. The vulnerability stems from improper memory management during the processing of SSTP traffic. Exploitation of this flaw enables an attacker to achieve Remote Code Execution (RCE) on affected Windows systems, potentially leading to full system compromise. Because the vulnerability is reachable over a network without requiring authentication, it represents a high-risk security threat. Organizations are advised to prioritize security updates that address memory corruption issues within the SSTP service to prevent unauthorized remote exploitation.",
  "technicalDetails": "The vulnerability resides in the Windows SSTP component, specifically within the kernel-mode driver responsible for parsing and handling encapsulated SSTP control packets. A Use-After-Free condition occurs when the system fails to correctly manage the lifecycle of an object in memory during the state transition of a tunnel connection. The root cause is a race condition or an improper cleanup sequence where an object representing an SSTP session or state is freed, but a reference to the freed memory remains active in a pointer or handle list.\nThe attack flow begins with the adversary sending malicious SSTP packets to the target machine's listener. By manipulating the sequence of these packets, an attacker can trigger the premature deallocation of an object while the handler continues to process subsequent operations. Once the memory is freed, the attacker can use heap grooming techniques—such as spraying the heap with controlled data—to occupy the previously freed memory location with an object containing attacker-defined function pointers or malicious data structures. When the SSTP component attempts to access the stale pointer, it instead references the attacker-controlled memory.\nBecause the SSTP service operates with high privileges within the Windows environment, successful exploitation allows the attacker to redirect execution flow to a payload of their choosing. This payload typically executes in the context of the system or the kernel, bypassing standard user-mode protections. The lack of authentication required for this interaction allows the exploit to be delivered over the network directly to the vulnerable listener, maximizing the potential impact. The exploit does not require local user interaction, making it highly effective for remote campaigns targeting Windows infrastructure that exposes SSTP or VPN endpoints."
}