CVE-2026-72983: Windows ICS Use After Free Vulnerability

CVE-2026-72983 Overview

CVE-2026-72983 is a use-after-free vulnerability in the Windows Internet Connection Sharing (ICS) service. An unauthenticated attacker can trigger the flaw over the network and execute arbitrary code in the context of the vulnerable service. The weakness is categorized as [CWE-416] Use After Free and requires no user interaction or prior privileges. Microsoft published the advisory on the Microsoft Security Response Center portal. Because ICS runs with elevated privileges on Windows hosts, successful exploitation yields full compromise of confidentiality, integrity, and availability.

Critical Impact
Unauthenticated remote code execution against Windows hosts running the Internet Connection Sharing service, enabling full system compromise without user interaction.

Affected Products

Microsoft Windows (versions running the Internet Connection Sharing service)
See the Microsoft Security Update CVE-2026-72983 advisory for the full list of affected builds
Systems with the SharedAccess (ICS) service enabled

Discovery Timeline

2026-09-08 - CVE-2026-72983 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72983

Vulnerability Analysis

The vulnerability resides in the Windows Internet Connection Sharing (ICS) service, which allows a host to share its internet connection with other devices on a local network. ICS handles inbound network requests to provide DHCP, DNS proxy, and NAT services. The service mishandles the lifecycle of an internal object, freeing memory while a reference remains in use. An attacker who reaches the service over the network can craft traffic that causes the freed object to be reused, redirecting execution flow. Because ICS runs as a privileged Windows service, code execution occurs at a level sufficient to install programs, view or change data, and create new accounts.

Root Cause

The defect is a use-after-free condition [CWE-416] in the ICS component. A code path releases a heap object without invalidating pointers that other code paths continue to dereference. When the freed allocation is reclaimed and repopulated with attacker-influenced data, subsequent dereferences operate on corrupted state. This allows the attacker to control function pointers, virtual table entries, or object fields consumed during request processing.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker on an adjacent or routed network sends specially crafted requests to a Windows host with ICS enabled. Refer to the Microsoft Security Update CVE-2026-72983 advisory for the technical scope of affected protocols and message types. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-72983

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the SharedAccess service or svchost.exe instance hosting ICS
New child processes spawned by the ICS-hosting svchost.exe process, especially command shells or scripting engines
Anomalous outbound network connections from the ICS service process after handling inbound traffic
Creation of new local accounts or scheduled tasks shortly after suspicious inbound ICS traffic

Detection Strategies

Monitor Windows Service Control Manager events for repeated ICS service failures that may indicate exploitation attempts
Alert on process-creation events where the parent is the svchost.exe instance hosting SharedAccess
Inspect network telemetry for malformed DHCP, DNS, or NAT traffic targeting hosts with ICS enabled
Correlate ICS service crashes with subsequent lateral movement or credential access activity

Monitoring Recommendations

Enable Windows Event Log forwarding for System and Security channels from hosts running ICS
Ingest endpoint process, network, and service telemetry into a centralized data lake for retroactive hunting
Baseline normal ICS process behavior and flag deviations in child processes and outbound connections
Track hosts where the SharedAccess service is set to Automatic or Manual start

How to Mitigate CVE-2026-72983

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-72983 advisory to all affected Windows hosts
Inventory endpoints and servers with the Internet Connection Sharing service enabled and prioritize patching
Restrict inbound network access to ICS-related ports at the perimeter and on host firewalls
Review logs for signs of prior exploitation on any exposed hosts

Patch Information

Microsoft has issued a security update addressing CVE-2026-72983. Consult the Microsoft Security Update CVE-2026-72983 advisory for build numbers, KB identifiers, and deployment guidance across supported Windows versions. Deploy the update through Windows Update, WSUS, Microsoft Intune, or your standard patch management tooling.

Workarounds

Disable the Internet Connection Sharing (SharedAccess) service on systems that do not require it and set its start type to Disabled
Block inbound traffic to ICS on untrusted network segments using Windows Defender Firewall or network ACLs
Segment networks so that hosts running ICS are not reachable from untrusted or internet-facing zones

bash

# Configuration example: disable the ICS service on systems that do not need it
sc.exe stop SharedAccess
sc.exe config SharedAccess start= disabled

# Verify the service is stopped and disabled
sc.exe query SharedAccess
sc.exe qc SharedAccess