CVE-2025-21216 Overview
CVE-2025-21216 is a denial of service vulnerability in the Microsoft Windows Internet Connection Sharing (ICS) service. The flaw stems from an out-of-bounds read condition [CWE-125] that an unauthenticated attacker on an adjacent network can trigger to disrupt the ICS service. Microsoft addressed the issue in its February 2025 security update cycle.
The vulnerability affects a broad range of client and server Windows editions, from Windows 10 1607 through Windows 11 24H2 and from Windows Server 2016 through Windows Server 2025. Successful exploitation impacts availability without compromising confidentiality or integrity.
Critical Impact
An unauthenticated adjacent attacker can trigger a denial of service against the ICS service, disrupting shared network connectivity for downstream clients.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-02-11 - CVE-2025-21216 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21216
Vulnerability Analysis
Internet Connection Sharing (ICS) is a Windows service that allows one host to share its internet connection with other devices on a local network. The service handles inbound network traffic on the adjacent network segment and parses protocol data as part of routing and address translation.
CVE-2025-21216 is classified as an out-of-bounds read [CWE-125]. When the ICS service processes a crafted network packet, it reads memory beyond the intended buffer boundary. The read operation causes the service to enter an error state, resulting in a denial of service condition that disrupts connectivity for hosts relying on the shared connection.
The attack vector is limited to an adjacent network, meaning the attacker must have access to the same broadcast domain, logical network segment, or a Layer 2 adjacent link. No authentication or user interaction is required. The vulnerability does not permit code execution or data disclosure based on Microsoft's advisory.
Root Cause
The root cause is improper validation of input length or offset fields in a network protocol handler within the ICS service. The service reads past the end of a buffer when parsing attacker-controlled network data, leading to an unhandled fault and service disruption.
Attack Vector
An attacker positioned on an adjacent network sends a crafted packet to a host running ICS. The service processes the packet, triggers the out-of-bounds read, and terminates or becomes unresponsive. Downstream clients lose access to the shared network connection until the service is restored.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Response Center advisory for the vendor's technical description.
Detection Methods for CVE-2025-21216
Indicators of Compromise
- Unexpected termination or repeated restarts of the SharedAccess service (Internet Connection Sharing) recorded in the Windows Service Control Manager event log.
- Loss of connectivity for downstream clients that rely on an ICS host, correlated with anomalous inbound traffic on the ICS-facing interface.
- Windows Error Reporting entries referencing the ICS service host process (svchost.exe hosting SharedAccess).
Detection Strategies
- Monitor Windows Event Logs for Service Control Manager events 7031, 7034, and 7036 associated with the SharedAccess service.
- Inspect network telemetry for malformed or unusual packets directed at ICS hosts on adjacent segments.
- Correlate service crash events with packet capture data collected at the ICS interface to identify triggering traffic patterns.
Monitoring Recommendations
- Baseline the availability and uptime of the ICS service on hosts where it is intentionally enabled, and alert on deviations.
- Track process crash telemetry for svchost.exe instances hosting SharedAccess and forward events to a centralized log platform for correlation.
- Audit hosts across the environment to identify systems where ICS is enabled but not required, and flag them for remediation.
How to Mitigate CVE-2025-21216
Immediate Actions Required
- Apply the February 2025 Microsoft security updates to all affected Windows client and server versions listed in the advisory.
- Inventory hosts running the SharedAccess service and prioritize patching systems that expose ICS to untrusted adjacent networks.
- Restrict adjacent network access to ICS hosts using network segmentation and Layer 2 controls where feasible.
Patch Information
Microsoft released fixes as part of its scheduled security updates. Consult the Microsoft Vulnerability CVE-2025-21216 advisory for KB article identifiers and update packages that correspond to each affected Windows build.
Workarounds
- Disable Internet Connection Sharing on hosts where it is not required by stopping and disabling the SharedAccess service.
- Apply host-based firewall rules to block inbound traffic to the ICS-facing interface from untrusted sources on the adjacent network.
- Isolate ICS hosts on dedicated network segments with strict access control lists to limit which devices can communicate with the service.
# Disable the Internet Connection Sharing service on Windows hosts where ICS is not required
sc.exe config SharedAccess start= disabled
sc.exe stop SharedAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
