Windows Server 2012 CVE-2026-32075

Local user account with standard privileges on Windows system with UPnP Device Host service enabled. Attacker must trigger specific sequence of UPnP device operations under high complexity conditions to exploit use-after-free vulnerability.

The CVSS 7.0 score reflects high impact potential (complete confidentiality, integrity, and availability compromise) but is constrained by local attack vector (AV:L), high attack complexity (AC:H), and low privilege requirements (PR:L). The AC:H designation suggests exploitation requires winning a race condition or precise timing, reducing reliability. No confirmed active exploitation (CISA KEV) and no public exploit code exist at time of analysis. The local-only nature means attackers must already have established initial access with low-privileged credentials, positioning this as a second-stage attack rather than an entry vector. SSVC framework assessment: exploitation status is none (proof-of-concept not public), automatable is no (requires local interactive access and likely timing precision), technical impact is total (full system compromise from low privileges). Real-world risk is moderate - this is a genuine privilege escalation primitive for attackers who have already breached the perimeter through phishing, supply chain, or other means, but it does not enable remote compromise or wormable propagation. Organizations with robust endpoint detection and privileged access management can mitigate risk through monitoring, while patch priority should follow standard enterprise deployment cycles rather than emergency response.

An attacker who has compromised a domain user account through phishing or credential theft authenticates to a target Windows workstation or server. The attacker executes a crafted exploit binary that interacts with the UPnP Device Host service, triggering the use-after-free condition through carefully timed API calls or race condition exploitation. By manipulating the freed memory region before reallocation, the attacker redirects execution flow to injected shellcode, escalating from low-privileged user context to SYSTEM-level privileges. With elevated access, the attacker can disable security controls, deploy ransomware, exfiltrate sensitive data, or establish persistent backdoors for long-term access.