CVE-2026-72930 in Windows
Summary
by MITRE • 09/09/2026
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free flaw within the Microsoft Windows Secure Socket Tunneling Protocol, commonly referred to as SSTP, represents a critical memory management error that can lead to arbitrary code execution on affected systems. This specific class of vulnerabilities occurs when software continues to use a pointer after it has been freed or deallocated from memory. In the context of SSTP, which is designed to provide secure remote access by encapsulating Point-to-Point Protocol (PPP) frames within HTTPS connections, improper handling of network packets can result in the protocol stack referencing memory regions that have already been released back to the system allocator. This discrepancy creates a window where an attacker can manipulate the state of the application or operating system kernel through carefully crafted inputs.
From a technical perspective, this flaw allows an authorized attacker who is authenticated to the target Windows machine to exploit the race condition or logic error in memory management. By sending specially constructed SSTP packets, the attacker can trigger the premature freeing of specific data structures while other parts of the protocol stack still hold references to them. When these dangling pointers are subsequently accessed, they may point to newly allocated memory that contains attacker-controlled content. This scenario effectively allows for arbitrary code execution with the privileges of the current user or potentially higher depending on the context in which SSTP is operating. The severity of this issue is compounded by its potential impact on system integrity and confidentiality, as successful exploitation could grant an adversary full control over the compromised host.
The operational impact of exploiting this vulnerability extends beyond simple code execution. An attacker leveraging this flaw can install programs, view, change, or delete data, and create new accounts with full user rights if the current application is running with elevated privileges. This significantly expands the attack surface for lateral movement within a corporate network, as SSTP is frequently used to establish secure tunnels between remote users and internal resources. If an attacker gains access via this vector, they can pivot from the initial entry point to more critical systems, exfiltrate sensitive data, or deploy additional malware such as ransomware or command-and-control agents. The ability to execute code locally without requiring physical access makes this a high-risk vulnerability for organizations relying on SSTP for remote workforce connectivity.
Industry standards classify this type of memory corruption under CWE-416, which denotes Use After Free vulnerabilities. This classification highlights the fundamental failure in ensuring that pointers are nullified after deallocation or that checks are performed to verify pointer validity before use. Furthermore, from a tactical perspective aligned with the MITRE ATT&CK framework, exploitation of this vulnerability falls under techniques associated with privilege escalation and defense evasion. Attackers often utilize such memory corruption bugs to bypass security controls and establish persistent access. The specific context of SSTP places it within network service exploitation vectors, emphasizing the need for rigorous input validation and state management in protocols that handle sensitive remote connectivity functions.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Organizations should immediately apply the latest security updates provided by Microsoft to address this vulnerability in their Windows environments. Since SSTP is a network-facing service, it is crucial to ensure that only authorized users have access to these endpoints. Implementing strict authentication mechanisms and multi-factor authentication can reduce the likelihood of an attacker achieving the necessary level of authorization required to trigger the flaw. Additionally, deploying intrusion detection systems or endpoint protection solutions capable of detecting anomalous memory behavior may help identify exploitation attempts in real-time. For environments where SSTP is not strictly necessary, disabling the service entirely reduces the attack surface and eliminates this specific risk vector. Regular security audits and penetration testing should also be conducted to verify that patches are correctly applied and that no residual vulnerabilities remain exploitable by sophisticated adversaries.