EUVD-2026-22463
GHSA-p4gm-5fr5-gvj4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Universal Plug and Play (UPnP) Device Host affects all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Authenticated local attackers with low privileges can exploit an untrusted pointer dereference (CWE-822) to achieve complete system compromise with high impact to confidentiality, integrity, and availability. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, thoug
Technical ContextAI
The vulnerability stems from CWE-822 (Untrusted Pointer Dereference) within the Windows UPnP Device Host service, a component responsible for discovering and controlling networked devices using the Universal Plug and Play protocol. Pointer dereference vulnerabilities occur when software attempts to access memory using a pointer that has not been properly validated, allowing attackers to control what memory location is accessed. In this case, the UPnP Device Host service fails to properly validate pointer references before dereferencing them, enabling an authenticated local user to manipulate memory operations. The vulnerability affects the upnphost service running with elevated system privileges, creating a classic local privilege escalation vector. The affected CPE strings span Windows 10 versions 1607 through 22H2, Windows 11 versions 22H3 through 26H1, and Windows Server versions from 2012 through 2025, indicating a long-standing architectural issue in the UPnP implementation across multiple Windows generations.
RemediationAI
Apply the security updates released by Microsoft through Windows Update or the Microsoft Update Catalog immediately. Fixed versions include Windows 10 Version 1607 build 10.0.14393.9060 or later, Windows 10 Version 1809 build 10.0.17763.8644 or later, Windows 10 Version 21H2 build 10.0.19044.7184 or later, Windows 10 Version 22H2 build 10.0.19045.7184 or later, Windows 11 versions 22H3 and 23H2 build 10.0.22631.6936 or later, Windows 11 Version 24H2 build 10.0.26100.32690 or later, Windows 11 Version 25H2 build 10.0.26200.8246 or later, Windows 11 Version 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2012 R2 build 6.3.9600.23132 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Detailed patch information is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27919. As a temporary workaround if immediate patching is not possible, organizations may consider disabling the UPnP Device Host service on systems where UPnP functionality is not required, though this should be carefully evaluated for operational impact.
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today