Product:
Windows Internet Connection Sharing
Summary
An out-of-bounds read vulnerability in Windows Internet Connection Sharing allows an unauthorized attacker to disclose sensitive information through a physical attack. This issue can lead to significant confidentiality impacts, making it critical for users to be aware of potential risks. The vulnerability does not require any privileges or user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2026-20828 |
Exploitation
To exploit this vulnerability, an attacker must have physical access to the affected system. By manipulating the Internet Connection Sharing feature, the attacker can trigger an out-of-bounds read, potentially revealing sensitive information stored in memory. This type of attack is particularly concerning in environments where physical security cannot be guaranteed.
Affected Products
- Windows Internet Connection Sharing: A feature that allows multiple devices to share a single internet connection, which is vulnerable to unauthorized information disclosure.
Mitigation
To mitigate this vulnerability, it is essential to restrict physical access to systems using Windows Internet Connection Sharing. Additionally, users should apply any available security updates from Microsoft to address this issue and enhance overall system security.