{"id":"CVE-2026-118124","kind":"vulnerability","aliases":["CVE-2026-118124"],"related":[],"title":"Windows ICS: out-of-bounds read lets a local user gain privileges","description":"Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.","summary":"Windows Internet Connection Sharing has an out-of-bounds read flaw. An authorized local attacker can use it to elevate privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Internet Connection Sharing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","internet-connection-sharing","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:52:05+00:00","updated_at":"2026-11-10T19:52:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:52:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows ICS: out-of-bounds read lets a local user gain privileges","impact":"high","summary":"Windows Internet Connection Sharing has an out-of-bounds read flaw. An authorized local attacker can use it to elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","internet-connection-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains higher privileges on the Windows machine","analyst_note":"Confirm affected Windows builds, whether ICS must be enabled, and the Microsoft patch from the MSRC advisory for CVE-2026-118124.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Internet Connection Sharing","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only Windows machines where Internet Connection Sharing is in use are in scope per the sources, and an attacker must already have local authorized access. Sources do not say which Windows builds are affected or whether the feature must be enabled. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4507,"output_tokens":458,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds, whether ICS must be enabled, and the Microsoft patch from the MSRC advisory for CVE-2026-118124.","search":"'-118124':16A,19A '-2026':15A,18A 'allow':66C 'attack':45B,69C 'author':43B,68C 'bound':6A,39B,58C 'connect':27B,32B,63C 'connection':22A 'cve':14A,17A 'elev':50B,71C 'flaw':41B 'gain':12A 'ic':2A,65C 'infrastructur':24B 'internet':21A,26B,31B,62C 'internet-connection-shar':25B 'let':8A 'local':10A,44B,73C 'machin':54B 'out-of-bound':3A,36B,55C 'privileg':13A,51B,72C 'read':7A,40B,59C 'share':28B,33B,64C 'sharing':23A 'use':47B 'user':11A 'window':1A,29B,30B,61C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines where Internet Connection Sharing is in use are in scope per the sources, and an attacker must already have local authorized access. Sources do not say which Windows builds are affected or whether the feature must be enabled. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["internetconnectionsharing","windowsinternetconnectionsharing"],"ptokens":["connection","internet","sharing","windows"],"labels":["high","infrastructure","internetconnectionsharing","vendor","windows"],"campaign_type":null,"search_a":"'-118124':16A,19A '-2026':15A,18A 'bound':6A 'connection':22A 'cve':14A,17A 'gain':12A 'ic':2A 'internet':21A 'let':8A 'local':10A 'out-of-bound':3A 'privileg':13A 'read':7A 'sharing':23A 'user':11A 'window':1A 'windows':20A","search_b":"'attack':45B 'author':43B 'bound':39B 'connect':27B,32B 'elev':50B 'flaw':41B 'infrastructur':24B 'internet':26B,31B 'internet-connection-shar':25B 'local':44B 'machin':54B 'out-of-bound':36B 'privileg':51B 'read':40B 'share':28B,33B 'use':47B 'window':29B,30B","search_c":"'allow':66C 'attack':69C 'author':68C 'bound':58C 'connect':63C 'elev':71C 'ic':65C 'internet':62C 'local':73C 'out-of-bound':55C 'privileg':72C 'read':59C 'share':64C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118124","severity":null,"published_at":"2026-11-10T19:19:31+00:00","modified_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}