Executive brief
Windows Internet Connection Sharing (ICS) is a Windows component that allows users to share internet connections between devices on a network. A use-after-free vulnerability in this component could allow an authenticated attacker with local access to escalate their privileges to system level, potentially compromising the entire machine.
Technical details
A use-after-free vulnerability exists in Microsoft Windows Internet Connection Sharing (ICS) that can be exploited for local privilege escalation. The vulnerability requires an authorized attacker with local access to the system. By exploiting this memory safety issue, an attacker can execute arbitrary code with elevated privileges. Microsoft has issued a security patch to address this vulnerability.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed