Windows ICS EUVD-2026-73100

Exploitation requires a locally authenticated user account with at minimum standard (low) privileges on the target Windows system (CVSS PR:L). The Internet Connection Sharing service (SharedAccess) must be present and reachable on the host, as the vulnerability resides within its code path; ICS is not universally enabled across all Windows deployments, particularly in hardened server environments. The AC:H metric indicates a race condition must be won, meaning exploitation is not a simple single-shot operation and requires timing or heap-state control. Limiting factors: the attack is strictly local (AV:L), ruling out all remote and network-based exploitation; standard user access is required rather than a fully unprivileged pre-auth attacker; and the race-condition requirement (AC:H) reduces the reliability of any exploitation attempt. Remote and unauthenticated attack vectors are not supported by the available CVSS data.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is credible and internally consistent: the attack is local, requires low privileges, and demands a race condition (AC:H) to trigger the use-after-free reliably. The full C/I/A impact block reflects privilege escalation to SYSTEM, which grants complete host control. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, meaning active exploitation has not been confirmed. The AC:H barrier meaningfully reduces near-term mass exploitation probability compared to AC:L flaws - reliable weaponization requires non-trivial heap-spray or timing techniques. Even so, the breadth of affected Windows versions - from Windows 10 1607 through current Windows 11 and Server 2025 builds - means the unpatched attack surface is very large, and any mid-sized organizational IT team should prioritize patch deployment, especially on hosts or servers where ICS is enabled. The 'Denial Of Service' tag in the input metadata somewhat mischaracterizes the described primary impact, which is privilege escalation; while UAF flaws can produce service crashes, the vendor explicitly frames this as an EoP vulnerability.

A low-privileged local user on an unpatched Windows system identifies that the ICS service is running and crafts a sequence of operations that triggers a race condition in the service's memory management, causing a heap object to be freed while a stale pointer is retained. The attacker then positions a controlled allocation in the freed region - via heap spray or similar technique - and triggers the dangling-pointer dereference to redirect execution within the ICS process, ultimately achieving SYSTEM-level privilege. No public exploit code has been identified at time of analysis, so reliable exploitation currently requires original research into ICS memory internals.