CVE-2026-20828: Windows 10 1607 Information Disclosure

CVE-2026-20828 Overview

CVE-2026-20828 is an out-of-bounds read vulnerability [CWE-125] in the Windows Internet Connection Sharing (ICS) service. The flaw allows an unauthorized attacker with physical access to a target system to read memory outside the bounds of an intended buffer, leading to information disclosure. Microsoft has confirmed the issue affects a broad range of Windows client and server releases, from legacy Windows Server 2008 through Windows 11 25H2 and Windows Server 2025. Exploitation requires no privileges or user interaction, but the physical attack vector limits practical exploitation to scenarios where an adversary can directly interact with the affected hardware.

Critical Impact
A successful attack discloses sensitive memory contents from the ICS component, which may include credentials, network configuration data, or other process memory that aids further compromise.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-01-13 - CVE-2026-20828 published to NVD
2026-01-15 - Last updated in NVD database

Technical Details for CVE-2026-20828

Vulnerability Analysis

The vulnerability resides in the Windows Internet Connection Sharing (ICS) service, a component that allows a Windows host to share its internet connection with other devices on a local network. ICS handles DHCP, DNS proxy, and NAT functions, and processes network-related data structures during these operations.

The defect is an out-of-bounds read condition. ICS reads beyond the allocated boundary of a memory buffer when handling specific input. The disclosed memory may contain residual data from prior allocations, including configuration values, pointers useful for bypassing address space layout randomization (ASLR), or fragments of sensitive process memory.

The CVSS vector indicates the attack must originate from a physically connected interface and yields high confidentiality impact with no integrity or availability impact. This is consistent with a pure information-disclosure primitive.

Root Cause

The root cause is missing or incorrect bounds checking on a read operation within the ICS code path. When ICS parses an attacker-influenced data structure, it dereferences memory at an offset that exceeds the allocated size of the source buffer. The lack of length validation against the underlying buffer permits the read to extend into adjacent memory regions.

Attack Vector

Exploitation requires physical access, which in this context typically means attaching a malicious device to a physical port on the target, such as USB or a directly cabled network interface used by ICS. The attacker submits crafted input that triggers the unbounded read in the ICS service, then receives the leaked memory contents through ICS responses. No authentication is required, and no user interaction on the host is needed.

No public proof-of-concept exploit code is available for CVE-2026-20828 at the time of publication. Refer to the Microsoft Security Update CVE-2026-20828 advisory for component-specific technical guidance.

Detection Methods for CVE-2026-20828

Indicators of Compromise

Unexpected presence or recent activation of the Internet Connection Sharing (SharedAccess) service on endpoints or servers where it is not operationally required.
Unrecognized USB network adapters, USB-to-Ethernet dongles, or other physical network devices attached to systems running ICS.
Anomalous DHCP, DNS, or NAT traffic patterns generated by the ICS service that do not align with documented network sharing use cases.

Detection Strategies

Inventory and continuously monitor the state of the SharedAccess service across the fleet and alert on transitions from Stopped or Disabled to Running.
Correlate physical device insertion events (USB, network adapter changes) from Windows event logs with ICS service activity to identify suspicious co-occurrence.
Apply the January 2026 Microsoft cumulative update and use vulnerability management tooling to verify patch presence on all affected Windows builds enumerated in the advisory.

Monitoring Recommendations

Forward Windows Security, System, and DriverFrameworks-UserMode operational logs to a central analytics platform for review of device insertions and service state changes.
Monitor process memory access patterns and crashes of svchost.exe instances hosting the SharedAccess service, which can indicate exploitation attempts.
Track Microsoft Defender and endpoint protection telemetry for detections related to ICS abuse and physical-vector tooling.

How to Mitigate CVE-2026-20828

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-20828 advisory to all affected Windows client and server systems.
Disable the Internet Connection Sharing service on any host where it is not explicitly required for business operations.
Enforce physical security controls on endpoints and servers, including USB port restrictions and tamper-evident enclosures in unattended environments.

Patch Information

Microsoft has issued a security update addressing CVE-2026-20828. Patch availability and KB article identifiers for each affected Windows release are listed in the official Microsoft Security Update CVE-2026-20828 advisory. Administrators should deploy the relevant cumulative update through Windows Update, Windows Server Update Services (WSUS), or their preferred patch management solution.

Workarounds

Stop and disable the SharedAccess service via sc.exe config SharedAccess start= disabled where ICS is not required.
Restrict physical port access using Group Policy device installation restrictions to block unauthorized USB network adapters.
Limit administrative accounts permitted to enable or reconfigure ICS through least-privilege controls and audit policy.

bash

# Configuration example: disable the Internet Connection Sharing service
sc.exe stop SharedAccess
sc.exe config SharedAccess start= disabled