Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Double free (CWE-415) via a race in the Windows Secure Socket Tunneling Protocol service sstpsvc.dll SSTP-over-HTTP call-context handling, unauthenticated remote code execution (AV:N, AC:H race). SSTP tunnels PPP over HTTPS; sstpsvc processes HTTP request/response call contexts, each reference-counted (a refcount field at context+0xd0) and freed when the count reaches zero. The HTTP receive-completion callback SstpWebReceiveResponseCompletion drops the call-context reference (DereferenceRefCount(ctx+0xd0)); disconnect/cleanup paths (DisconnectServerHttpCallContext / InitiateCallContextCleanup / HttpThreadPoolRequestQueueCallback) also release it. PRE: under a race between the receive-completion path and the disconnect/cleanup path, the call-context reference could be dropped twice (or the context freed twice), a double free that corrupts the heap. Because the service is reachable over the network without authentication, the double free is a remote code-execution primitive (Microsoft rates it Critical, AC:H race). Diff of sstpsvc.dll 10.0.26100.8875 -> .9168 (Aug 11 2026, KB5121003) confirms the fix: gated behind CFR flag Feature_1207409977, SstpWebReceiveResponseCompletion restructures the DereferenceRefCount(ctx+0xd0) handling to use a null-guarded local (lVar10) so the call-context reference is dropped exactly once per path, and the surrounding cleanup (InitiateCallContextCleanup / DisconnectServerHttpCallContext / DereferenceRefCount) is reworked so the context is freed once. Note: the double-free fix is confirmed as the Feature_1207409977-gated rework of the call-context reference drop; the exact doubly-freed allocation is the reference-counted SSTP call context (freed at refcount zero).

An SSTP call context's reference is dropped twice in the HTTP receive-completion vs disconnect race, freeing it twice

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Microsoft has not published researcher acknowledgments for this CVE, or they are not yet reflected in our data source. Check the MSRC advisory directly for the most current credit information.