Windows ICS CVE-2026-72983

Exploitation requires the target Windows host to have the Internet Connection Sharing (ICS) feature enabled and its service reachable over the network - ICS is not enabled by default, which is the primary limiting factor that shrinks the real-world attack surface. Given CVSS PR:N/UI:N, no authentication or user interaction is needed once ICS is running, but as a use-after-free the attacker must reliably trigger and win the free/reuse timing to achieve code execution rather than a crash. Any supported Windows build below the fixed version for its branch is vulnerable when ICS is active.

The Microsoft CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) portrays a trivially exploitable unauthenticated network RCE, and SSVC reinforces concern with Automatable:yes and Technical Impact:total. However, these signals are partly in tension with real-world exploitability: SSVC Exploitation is 'none' and there is no KEV listing and no known POC, and reliable use-after-free RCE typically requires winning a race and grooming the heap - which argues the practical attack complexity is higher than AC:L suggests. Critically, ICS is not enabled by default on most Windows systems, so despite the ubiquity of the OS the attack surface is limited to hosts where the ICS feature is actively configured. Net: patch promptly on any host running ICS given the total-impact/automatable profile, but the population of exploitable systems is far smaller than the 9.8 alone implies. EPSS was not provided.

An attacker with network reachability to a Windows host that has ICS enabled sends a crafted sequence of packets/requests to the ICS service to trigger the use-after-free, grooming the heap to reoccupy the freed object and redirect execution. With no authentication or user interaction required, successful exploitation yields code execution in the context of the ICS service, leading to full host compromise. No public exploit code has been identified at time of analysis.