{"id":"CVE-2026-122179","kind":"vulnerability","aliases":["CVE-2026-122179"],"related":[],"title":"Windows ICS: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows Internet Connection Sharing lets an authorized attacker raise their privileges on the local machine. The attacker needs an existing local account, and the flaw is not reachable from the network according to the description.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["heap-overflow","infrastructure","internet-connection-sharing","local-privilege-escalation","windows"],"not_affected_if":[],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build (10.0.<build>.<revision>) with the fixed build for your Windows version. Lower than fixed means unpatched. Microsoft's record does not say whether ICS must be enabled; treat any unpatched host as exposed, and prioritise multi-user machines and servers.","fix":"Install the November 2026 Windows cumulative update: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Server 2022 10.0.20348.5870; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H2 10.0.26300.9974; Win11 26H1 10.0.28000.3501; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:50:12+00:00","updated_at":"2026-11-10T21:38:49+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-10T19:50:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows ICS: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Internet Connection Sharing lets an authorized attacker raise their privileges on the local machine. The attacker needs an existing local account, and the flaw is not reachable from the network according to the description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","internet-connection-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the Windows machine","analyst_note":"Check Microsoft's MSRC entry for CVE-2026-122179 for affected Windows builds, whether ICS must be enabled, and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where Internet Connection Sharing is present; the sources do not say whether it must be enabled. Attackers need a local authorized account first. unknown for the rest.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4508,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's MSRC entry for CVE-2026-122179 for affected Windows builds, whether ICS must be enabled, and the patch.","search":"'-122179':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':38A,41A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':36A '2025':54A '21h2':30A '22h2':33A '23h2':39A '24h2':42A '25h2':45A '26h1':51A '26h2':48A 'accord':106B 'account':96B 'allow':121C 'attack':82B,91B,124C 'author':81B,123C 'base':71B,112C 'buffer':72B,113C 'connect':61B,77B,118C 'cve':12A,15A 'descript':109B 'elev':126C 'escal':66B 'exist':94B 'flaw':99B 'gain':9A 'heap':3A,56B,70B,111C 'heap-bas':69B,110C 'heap-overflow':55B 'higher':10A 'ic':2A,120C 'infrastructur':58B 'internet':60B,76B,117C 'internet-connection-shar':59B 'let':5A,79B 'local':7A,64B,88B,95B,128C 'local-privilege-escal':63B 'machin':89B 'need':92B 'network':105B 'overflow':4A,57B,73B,114C 'privileg':11A,65B,85B,127C 'rais':83B 'reachabl':102B 'server':21A,26A,35A,53A 'share':62B,78B,119C 'user':8A 'window':1A,67B,75B,116C 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","nicknames":[],"mitigations":[],"who_affected":"Windows machines where Internet Connection Sharing is present; the sources do not say whether it must be enabled. Attackers need a local authorized account first. unknown for the rest.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:38:49Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-122179","run_id":2829},"products":{"at":"2026-11-10T21:38:49Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-122179","run_id":2829}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["heapoverflow","high","infrastructure","internetconnectionsharing","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-122179':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':38A,41A,44A,47A,50A '1607':20A '1809':25A '2016':22A '2019':27A '2022':36A '2025':54A '21h2':30A '22h2':33A '23h2':39A '24h2':42A '25h2':45A '26h1':51A '26h2':48A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'ic':2A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'server':21A,26A,35A,53A 'user':8A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","search_b":"'accord':106B 'account':96B 'attack':82B,91B 'author':81B 'base':71B 'buffer':72B 'connect':61B,77B 'descript':109B 'escal':66B 'exist':94B 'flaw':99B 'heap':56B,70B 'heap-bas':69B 'heap-overflow':55B 'infrastructur':58B 'internet':60B,76B 'internet-connection-shar':59B 'let':79B 'local':64B,88B,95B 'local-privilege-escal':63B 'machin':89B 'need':92B 'network':105B 'overflow':57B,73B 'privileg':65B,85B 'rais':83B 'reachabl':102B 'share':62B,78B 'window':67B,75B","search_c":"'allow':121C 'attack':124C 'author':123C 'base':112C 'buffer':113C 'connect':118C 'elev':126C 'heap':111C 'heap-bas':110C 'ic':120C 'internet':117C 'local':128C 'overflow':114C 'privileg':127C 'share':119C 'window':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122179","severity":null,"published_at":"2026-11-10T19:20:35+00:00","modified_at":"2026-11-10T19:20:36+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122179:2829","url":"https://cveawg.mitre.org/api/cve/CVE-2026-122179","severity":null,"published_at":"2026-11-10T21:38:49+00:00","modified_at":"2026-11-10T21:38:49+00:00","first_seen_at":"2026-11-10T21:38:49+00:00","fetched_at":"2026-11-10T21:38:49+00:00","note":"Microsoft's CNA record (cve.org API) gives affected builds and fixed builds; MSRC page is JS-only and unreadable here. Not stated: whether ICS must be enabled, mitigations, exploitation (record says E:U, not exploited). Fix and products verified against Microsoft's record only.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-122179"]}],"documents":[{"id":118967,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-122179","title":"CVE-2026-122179 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}