Windows ICS CVE-2026-85856

Exploitation requires that the target Windows host has the Internet Connection Sharing (ICS) feature running - ICS is not enabled by default on typical Windows client or server installs, so vulnerable surface is limited to systems where an administrator has deliberately enabled network sharing. The attacker must also (1) hold low-privilege authenticated access per PR:L and (2) have adjacent-network position (AV:A) - i.e., be on the same local/link-local network segment as the target, not across a routed internet path. Additionally, AC:H indicates the attacker must satisfy exploitation-specific conditions (heap layout grooming and race/timing) that are not fully under their control. These limiting factors - non-default feature, required local privileges, same-segment proximity, and high complexity - substantially reduce realistic risk below what the 7.1 score suggests.

This is a moderately-high-priority but not emergency-tier issue. The CVSS 3.1 base score of 7.1 (HIGH) is materially constrained by its vector: AV:A limits exploitation to an adjacent network (same subnet/link-local segment, not routable internet), AC:H signals a non-trivial exploit requiring specific timing or heap-grooming conditions typical of heap overflows (CWE-122), and PR:L requires the attacker to already hold low-level authenticated access on an affected host. The one strongly favorable signal for an attacker is UI:N (no user interaction) combined with full C:H/I:H/A:H impact and potential code execution. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not conflict so much as they are simply absent, which keeps near-term real-world risk lower than the raw 7.1 implies. Net: the combination of adjacent-only vector, high attack complexity, and required privileges makes this a patch-in-normal-cycle issue rather than a drop-everything priority, with the caveat that it affects the near-ubiquitous Windows platform so the aggregate exposed population is enormous. Note that ICS is not enabled by default on most Windows hosts, which further narrows realistic exploitability.

An attacker who has already gained a low-privileged foothold on a machine sharing a local network segment with a Windows host running Internet Connection Sharing sends specially crafted traffic to the ICS service to corrupt heap memory. By carefully grooming the heap and winning the timing conditions implied by the high attack complexity, they trigger the heap-based buffer overflow to execute arbitrary code on the target. No public exploit code was identified in the provided data, and the AC:H and adjacent-network constraints make reliable exploitation non-trivial.