CVE-2025-21254 Overview
CVE-2025-21254 is a denial of service vulnerability affecting the Internet Connection Sharing (ICS) component in Microsoft Windows. An unauthenticated attacker on an adjacent network can send crafted traffic to a vulnerable ICS host, causing the service to become unavailable. The flaw is tracked under [CWE-125] (out-of-bounds read) and impacts availability without compromising confidentiality or integrity.
Microsoft addressed the issue in the February 2025 security updates. The vulnerability affects a broad range of supported Windows client and server releases running the ICS role or component.
Critical Impact
Successful exploitation halts the ICS service, disrupting shared internet connectivity for downstream clients that depend on the affected host for network access.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-02-11 - CVE-2025-21254 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21254
Vulnerability Analysis
The vulnerability resides in the Internet Connection Sharing (ICS) service, a Windows component that allows one machine to share its internet connection with other devices on a local network. ICS handles DHCP, DNS proxying, and network address translation (NAT) for connected clients.
The flaw is classified as an out-of-bounds read [CWE-125]. When ICS parses specific network traffic from an adjacent network peer, it reads memory outside the intended buffer boundary. This triggers a fault condition that terminates the service and disrupts availability for downstream clients.
Exploitation does not require authentication or user interaction. However, the attacker must have access to the same logical network segment as the target, limiting remote reachability across the public internet.
Root Cause
The root cause is improper bounds checking during the processing of an inbound network protocol structure handled by ICS. Missing or insufficient length validation permits the service to reference memory beyond an allocated buffer, resulting in a process crash rather than data disclosure.
Attack Vector
The attack originates from an adjacent network, meaning the attacker must be positioned on the same broadcast domain, VLAN, or logical link as the vulnerable ICS host. A crafted packet sent to the ICS listener causes the service to abort, denying shared connectivity to all clients that route through that host. No credentials or victim interaction are needed.
No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update CVE-2025-21254 advisory for vendor-provided technical context.
Detection Methods for CVE-2025-21254
Indicators of Compromise
- Unexpected termination or repeated restarts of the SharedAccess (Internet Connection Sharing) service in the Windows Service Control Manager event log.
- Loss of network connectivity for downstream clients that rely on an ICS host for DHCP, DNS, or NAT services.
- Windows Error Reporting (WER) crash entries referencing ICS-related modules on hosts with the ICS role enabled.
Detection Strategies
- Monitor Windows Event Logs for Service Control Manager events 7031, 7034, and 7036 tied to the SharedAccess service.
- Correlate ICS service crashes with anomalous inbound traffic on the local subnet, particularly malformed DHCP or protocol-parsing packets.
- Baseline expected ICS uptime on gateway hosts and alert on deviations that suggest repeated denial of service attempts.
Monitoring Recommendations
- Ingest Windows service and system logs from ICS-enabled hosts into a centralized SIEM for correlation and alerting.
- Deploy network monitoring on subnets that contain ICS hosts to identify unusual packet volumes or malformed frames from adjacent devices.
- Track patch compliance across all affected Windows client and server SKUs to ensure timely remediation.
How to Mitigate CVE-2025-21254
Immediate Actions Required
- Apply the February 2025 Microsoft security update that addresses CVE-2025-21254 to all affected Windows client and server systems.
- Inventory all systems with the Internet Connection Sharing service enabled and prioritize them for patching.
- Restrict physical and logical access to network segments where ICS hosts operate.
Patch Information
Microsoft released a security update for this vulnerability. Consult the Microsoft Security Update CVE-2025-21254 advisory for the KB article and update package corresponding to each affected Windows version.
Workarounds
- Disable the Internet Connection Sharing (SharedAccess) service on hosts where the functionality is not required.
- Segment ICS-enabled hosts onto isolated VLANs to reduce the population of adjacent devices that can reach the vulnerable listener.
- Enforce host-based firewall rules that limit inbound traffic to ICS listeners from known, trusted clients only.
# Disable the Internet Connection Sharing service where not required (PowerShell, elevated)
Stop-Service -Name SharedAccess -Force
Set-Service -Name SharedAccess -StartupType Disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.