CVE-2025-21212 Overview
CVE-2025-21212 is a denial of service vulnerability affecting the Internet Connection Sharing (ICS) component in Microsoft Windows. The flaw stems from an out-of-bounds read condition [CWE-125] that an unauthenticated attacker on an adjacent network can trigger without user interaction. Successful exploitation causes the ICS service or host to become unavailable, disrupting shared network connectivity for downstream clients. Microsoft disclosed the vulnerability as part of its February 2025 security update cycle. The issue affects a broad range of supported Windows client and server releases.
Critical Impact
Adjacent-network attackers can trigger a high-availability impact on the ICS service without authentication or user interaction, disrupting connectivity for hosts relying on the shared connection.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-02-11 - CVE-2025-21212 published to the National Vulnerability Database
- 2025-02-11 - Microsoft published advisory in the Security Update Guide
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21212
Vulnerability Analysis
The vulnerability resides in the Internet Connection Sharing (ICS) service, a Windows component that allows a host to share its internet connection with other devices on a local network. ICS handles Network Address Translation (NAT), DHCP allocation, and DNS proxying for connected clients. Processing a malformed request over the adjacent network causes the service to read memory outside the intended buffer boundary [CWE-125]. The out-of-bounds read leads to a service crash or unresponsive state, producing a denial of service condition. Confidentiality and integrity are not impacted, but availability is degraded until the service or host is restarted.
Root Cause
The root cause is an out-of-bounds read in the ICS request handling path. The affected code parses attacker-controlled protocol data without adequately validating length or offset fields, allowing reads beyond the allocated buffer. Microsoft has not published the specific function or parsing routine responsible for the boundary error.
Attack Vector
Exploitation requires network adjacency, meaning the attacker must reside on the same broadcast domain or logical network segment as the vulnerable ICS host. No authentication or user interaction is required. An attacker sends a crafted packet to the ICS service, triggering the out-of-bounds read and disrupting shared connectivity for downstream clients.
A public proof-of-concept is not available, and no exploit code has been released. Detailed technical analysis is limited to the vendor advisory referenced in the Microsoft Security Update Guide.
Detection Methods for CVE-2025-21212
Indicators of Compromise
- Unexpected termination or repeated restarts of the SharedAccess service (ICS) in the Windows Service Control Manager event log.
- Loss of connectivity for clients that route traffic through an ICS host, correlated with malformed inbound packets on the shared interface.
- Windows Error Reporting entries or crash dumps referencing the ICS service process.
Detection Strategies
- Monitor Windows Event Log for Service Control Manager events indicating that the Internet Connection Sharing (ICS) service stopped unexpectedly.
- Inspect network telemetry for anomalous or malformed traffic directed at ICS-enabled hosts from adjacent segments.
- Correlate ICS service failures with source hosts on the same subnet to identify potential attacker positions.
Monitoring Recommendations
- Enable service-availability alerts on hosts where ICS is deliberately enabled and required for business operations.
- Aggregate Windows service and crash telemetry into a centralized log platform to identify repeated crash patterns across endpoints.
- Track ICS service state as a health metric on affected Windows client and server SKUs until patches are applied.
How to Mitigate CVE-2025-21212
Immediate Actions Required
- Apply the February 2025 Microsoft security updates that address CVE-2025-21212 to all affected Windows client and server SKUs.
- Inventory hosts running the Internet Connection Sharing (ICS) service and prioritize patching for those exposed to untrusted adjacent networks.
- Disable the ICS service on hosts that do not require shared connectivity.
Patch Information
Microsoft released fixes for CVE-2025-21212 through its February 2025 Patch Tuesday cycle. Refer to the Microsoft Security Update Guide for the specific KB articles corresponding to each supported Windows version. Apply updates through Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management platform.
Workarounds
- Disable the SharedAccess (Internet Connection Sharing) service on hosts where it is not required.
- Segment ICS-enabled hosts away from untrusted networks such as guest wireless or shared VLANs.
- Restrict inbound traffic to ICS hosts using host-based firewall rules that limit exposure to trusted management sources.
# Disable the Internet Connection Sharing service on affected Windows hosts
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
