CVE-2026-85856: Windows ICS Buffer Overflow Vulnerability

CVE-2026-85856 Overview

CVE-2026-85856 is a heap-based buffer overflow [CWE-122] in the Windows Internet Connection Sharing (ICS) service. An authorized attacker on an adjacent network can trigger the overflow to execute arbitrary code on an affected host. Microsoft published the advisory on 2026-10-13 and tracks the issue through its security update guide.

The vulnerability requires low privileges and no user interaction, but exploitation complexity is high. Successful exploitation yields high confidentiality, integrity, and availability impact. The attacker must share a logical or physical network segment with the vulnerable Windows host running ICS.

Critical Impact
An authenticated adjacent-network attacker can achieve code execution on Windows systems running the Internet Connection Sharing service through heap memory corruption.

Affected Products

Microsoft Windows (versions running the Internet Connection Sharing service — see Microsoft's advisory for the full build list)
Windows Internet Connection Sharing (ICS) component
Refer to the Microsoft CVE-2026-85856 Update Guide for exact affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85856 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-85856

Vulnerability Analysis

The flaw resides in the Windows Internet Connection Sharing service, which provides NAT, DHCP, and DNS proxy functions to clients on a shared network segment. ICS parses network traffic from connected clients, and a parsing path mishandles buffer sizing on the heap. The result is a heap-based buffer overflow classified under [CWE-122].

Overflowing the heap allocation lets an attacker corrupt adjacent heap metadata or object pointers. In the Windows ICS service context, this can lead to arbitrary code execution within the service's security context. Because ICS typically runs with elevated system privileges, successful exploitation produces full host compromise.

The adjacent-network attack vector means the attacker cannot reach the service across the public internet. The attacker must sit on the same Layer 2 segment, VPN tunnel, or logical subnet as the vulnerable ICS host.

Root Cause

The root cause is improper validation of input size before copying data into a fixed-size heap buffer within the ICS service. Microsoft has not disclosed the specific function or protocol handler at fault. The Microsoft advisory is the authoritative source for component-level details.

Attack Vector

An attacker authenticates to the adjacent network and sends crafted protocol traffic to the ICS service. The malformed packets drive the service down a code path that writes attacker-controlled bytes past a heap buffer boundary. High attack complexity reflects the precise heap grooming or timing conditions required to achieve reliable code execution.

No public proof-of-concept exploit is available at the time of publication. The EPSS probability is 0.363%.

No verified exploit code is publicly available for CVE-2026-85856.
Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-85856

Indicators of Compromise

Unexpected crashes or restarts of the SharedAccess service (Internet Connection Sharing) on Windows hosts
Anomalous inbound traffic to ICS-enabled hosts from adjacent network peers, especially malformed DHCP, DNS, or NAT control packets
New or unexpected child processes spawned by svchost.exe instances hosting the ICS service

Detection Strategies

Monitor Windows Event Logs for service failures tied to SharedAccess and for Windows Error Reporting entries referencing ICS binaries
Baseline which hosts legitimately run ICS and alert on activation of the service elsewhere, since ICS is rarely enabled on managed endpoints
Correlate adjacent-network scanning activity with ICS service exceptions to identify exploitation attempts

Monitoring Recommendations

Enable EDR process-execution and memory-protection telemetry on hosts with ICS enabled
Capture packet traces on segments where ICS hosts are reachable to support post-incident analysis
Alert on code execution originating from the ICS service process context, which should normally not spawn interactive binaries

How to Mitigate CVE-2026-85856

Immediate Actions Required

Apply the Microsoft security update referenced in the CVE-2026-85856 Update Guide to all Windows hosts running ICS
Inventory endpoints and servers where the Internet Connection Sharing service is enabled and prioritize them for patching
Restrict adjacent-network access to ICS hosts using VLAN segmentation and host-based firewall rules

Patch Information

Microsoft released security updates addressing CVE-2026-85856. Consult the Microsoft CVE-2026-85856 Update Guide for the specific KB articles that correspond to each Windows build. Deploy patches through Windows Update, WSUS, Microsoft Update Catalog, or your configuration management system.

Workarounds

Disable the Internet Connection Sharing service (SharedAccess) on hosts that do not require it
Block untrusted peers at the switch or wireless controller level to limit adjacent-network reachability
Enforce network access control (802.1X) so only authenticated devices join segments containing ICS hosts

bash

# Disable the Internet Connection Sharing service on Windows (PowerShell, admin)
Stop-Service -Name SharedAccess -Force
Set-Service -Name SharedAccess -StartupType Disabled

# Verify the service state
Get-Service -Name SharedAccess