CVE-2026-73009 in Windows
Summary
by MITRE • 09/09/2026
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described involves a use-after-free condition within the Microsoft Windows Secure Socket Tunneling Protocol, commonly referred to as SSTP. This protocol is designed to provide secure remote access by encapsulating Point-to-Point Protocol frames inside HTTPS sessions, thereby allowing traffic to traverse firewalls that might otherwise block traditional VPN protocols like PPTP or L2TP. The core technical flaw lies in the memory management logic of the SSTP service implementation. Specifically, a pointer to a previously deallocated memory region is accessed after it has been freed by the system. This scenario typically occurs when an object is destroyed and its memory returned to the heap allocator, but subsequent code execution attempts to read from or write to that same memory address under the assumption that the object remains valid. In the context of SSTP processing network packets, this error can be triggered remotely if a malicious actor sends specially crafted data over the network connection established via the protocol.
From an operational perspective, the impact of this vulnerability is severe due to its potential for remote code execution. Because the flaw resides in a component that handles incoming network traffic, an attacker does not need physical access or local user credentials on the target machine. By exploiting the use-after-free condition during packet processing, an unauthorized actor can manipulate memory contents and redirect program flow. This capability allows the execution of arbitrary malicious code with the privileges of the process running SSTP, which often includes SYSTEM-level permissions depending on the configuration. Consequently, this vulnerability effectively compromises the confidentiality, integrity, and availability of the affected system, potentially leading to complete control over the host machine by an external threat actor.
The classification of this flaw aligns closely with Common Weakness Enumeration identifier CWE-416, which defines use-after-free errors as a critical category of memory corruption vulnerabilities. These weaknesses are particularly dangerous because they can lead to unpredictable behavior and are frequently targeted in exploit development due to their potential for high-impact outcomes such as privilege escalation or remote code execution. Furthermore, the exploitation vector relates to ATT&CK technique T1203, which covers Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side software to gain an initial foothold within a network environment. The ability to execute code over the network underscores the critical nature of this vulnerability and highlights the risks associated with services that process untrusted input from remote sources without sufficient validation or safe memory handling practices.
Mitigation strategies for this vulnerability primarily involve applying the security updates provided by Microsoft, which patch the underlying memory management logic in the SSTP service to prevent access to freed memory regions. Organizations should prioritize deploying these patches on all systems running vulnerable versions of Windows that utilize SSTP functionality. In addition to timely patching, network-level controls can help reduce exposure. Implementing strict firewall rules to restrict inbound connections to the SSTP port (typically TCP 443) only from trusted IP addresses or subnets can limit the attack surface available to remote attackers. Furthermore, enabling advanced logging and monitoring for anomalies in SSTP traffic patterns may aid in early detection of exploitation attempts before successful compromise occurs. Regular vulnerability assessments and penetration testing should also be conducted to identify any residual risks associated with legacy configurations or unpatched systems within the enterprise infrastructure.