External risk intelligence

Windows ICS Use After Free Network Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72983

Windows Internet Connection Sharing (ICS) is typically a feature used to share a local internet connection among devices on a private network. While it involves network traffic, it is generally intended for local, internal network management rather than being a public-facing internet service, making broad exposure to the public internet uncommon in standard deployment configurations.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Windows Internet Connection Sharing (ICS). If exploited, an unauthorized attacker could execute code remotely by sending specially crafted network traffic. The primary concern at this stage is to confirm if this specific technology is in use within our environment.

Flaw allows remote code execution.
Confirms if ICS is in use.
Understand potential network risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a use-after-free flaw in Windows Internet Connection Sharing (ICS) by sending specially crafted network traffic to a vulnerable system. This could allow them to execute arbitrary code remotely, leading to a complete compromise of the affected machine.

Network access required.
Triggered by crafted network traffic.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Windows Internet Connection Sharing (ICS) could allow an unauthenticated attacker to run malicious code over a network. When ICS is enabled and configured in specific ways, an attacker could exploit a use-after-free condition to achieve code execution.

System code execution.
Network-based exploitation.
Compromise of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Windows Internet Connection Sharing (ICS) likely requires coordinated action between infrastructure and security teams. The first step is to identify all ICS instances, determine their network exposure and business criticality, and locate the accountable system owners before planning remediation.

Infrastructure and Security teams own remediation.
Verify ICS network exposure and criticality.
Plan and execute targeted mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Windows Internet Connection Sharing (ICS)?

ICS is a Windows feature that enables a single computer to share its internet connection with other devices on a local area network, effectively acting as a gateway. It is commonly used in small office or home settings to provide network access to secondary devices without a dedicated router, though it can also be found in specific legacy configurations within larger environments.

How does this use-after-free vulnerability work?

This flaw is identified as CWE-416, which occurs when a program continues to use a memory address after that memory has been cleared or released. For CVE-2026-72983, an attacker sends specifically designed network traffic that confuses the system, causing it to access that freed memory. This can lead to unpredictable behavior, including the ability for an attacker to run their own unauthorized code on the system.

Do I need to worry about any network traffic triggering this?

Not all network traffic causes this issue. The vulnerability requires specifically crafted packets designed to exploit the memory management flaw in the ICS component. Normal, legitimate network traffic and standard data communication will not trigger this condition; the exploit requires a precise, intentional sequence of operations to corrupt memory.

Is my system at risk if it is not directly on the internet?

According to Halo Surface Signal, ICS is typically used for managing internal local networks rather than functioning as a public-facing service. While the flaw is network-based, systems that are not reachable from outside your private network or the internet have a significantly lower risk profile than those exposed directly to external traffic.

When should I start addressing CVE-2026-72983?

You should begin by verifying whether ICS is enabled on your systems. Since this service is often unnecessary in modern, managed network environments, identifying its active status is the essential first step. Once you locate where it is running, coordinate with your infrastructure team to assess whether the service can be safely disabled or if it requires further updates.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72983

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.