CVE-2026-20828: 
vulnerability analysis and mitigation

CVE-2026-20828 is an out-of-bounds read vulnerability in the Windows Internet Connection Sharing (ICS) component that allows an unauthorized attacker to disclose sensitive information via a physical attack. Disclosed on January 13, 2026, as part of Microsoft's January 2026 Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2008 SP2 through Windows Server 2025. It carries a CVSS v3.1 base score of 4.6 (Medium), reflecting the physical access requirement (Microsoft MSRC, Feedly).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), occurring within the Windows Internet Connection Sharing service. An attacker with physical access to the target device can trigger the ICS component to read memory beyond its intended boundaries, potentially exposing sensitive data stored in adjacent memory regions. No privileges or user interaction are required, but physical proximity to the device is a hard prerequisite. No public technical write-ups or proof-of-concept code have been identified at this time (Microsoft MSRC, Feedly).

Successful exploitation results in an information disclosure impact only — there is no effect on system integrity or availability. An attacker with physical access could read out-of-bounds memory from the ICS component, potentially extracting sensitive data such as credentials, encryption keys, or other in-memory secrets. The scope is limited to the affected system and does not enable remote code execution or lateral movement on its own (Feedly).

Microsoft released security updates on January 13, 2026, addressing this vulnerability across all affected platforms. Patched build versions include: Windows 10 1607/Server 2016 (10.0.14393.8783), Windows 10 1809/Server 2019 (10.0.17763.8276), Windows 10 21H2 (10.0.19044.6809), Windows 10 22H2 (10.0.19045.6809), Windows 11 23H2 (10.0.22631.6491), Windows 11 24H2 (10.0.26100.7623), Windows 11 25H2 (10.0.26200.7623), Windows Server 2022 (10.0.20348.4648), Windows Server 2022 23H2 (10.0.25398.2092), and Windows Server 2025 (10.0.26100.32230). Organizations should apply the January 2026 Patch Tuesday updates promptly and enforce physical security controls to restrict unauthorized physical access to Windows systems, particularly in sensitive environments (Microsoft MSRC).

The vulnerability was covered as part of broader January 2026 Patch Tuesday roundups by security outlets including BleepingComputer, Sophos, Zero Day Initiative, and CyberSecurityNews, though it received minimal individual attention given its medium severity and physical-only attack vector. Coverage was largely aggregated alongside the 114 total flaws addressed in the January 2026 update cycle, with community focus directed toward the three zero-days patched in the same release (BleepingComputer, ZDI, Sophos).