CVE-2026-20828: Microsoft Windows Internet Connection Sharing out-of-bounds read

CVE-2026-20828 · Severity: medium · CVSS 4.6 · Published 2026-01-13

A vulnerability in Windows Internet Connection Sharing (ICS) could allow an attacker with physical access to a computer to view sensitive information. ICS is a feature that allows one computer to share its internet connection with other devices on a local network. To exploit this, an attacker must have direct physical access to the machine, limiting the risk to scenarios where hardware is left unattended in insecure locations.

Technologies: Microsoft Windows 11, Microsoft Windows Server 2008 R2, Microsoft Windows 10. Vendors: Microsoft.

Quick answers

Is CVE-2026-20828 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20828 being exploited in the wild.
How severe is CVE-2026-20828?
Medium severity, with a CVSS score of 4.6, published 13 January 2026.
Which products and versions are affected?
Microsoft Windows 11 22H3, 23H2, 24H2, 25H2; Microsoft Windows Server 2008 R2 Service Pack 1; Microsoft Windows 10 1607, 1809, 21H2, 22H2.
Is there a fix for CVE-2026-20828?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20828 attacked?
It is attacked with physical access, in an operating system.
Am I affected by CVE-2026-20828?
Check whether you run Microsoft Windows 11, Microsoft Windows Server 2008 R2 or Microsoft Windows 10 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists within the Windows Internet Connection Sharing (ICS) service. The flaw is triggered when the service improperly handles memory buffers, allowing an attacker to read data beyond the intended memory range. Exploitation requires physical access to the target system (AV:P) but does not require prior authentication or user interaction. Successful exploitation results in the disclosure of sensitive information from the system's memory. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.

Affected products

  • Microsoft Windows 10 1607, 1809, 21H2, 22H2
  • Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
  • Microsoft Windows Server 2008 R2 Service Pack 1

Timeline

  • 2026-01-13: advisory: Initial publication of CVE-2026-20828 by Microsoft and NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.