Windows Server 2012 CVE-2026-32077

Authenticated local user account required. UPnP Device Host service must be running and listening for local UPnP protocol requests on Windows system.

Real-world risk is moderate despite the high CVSS 7.8 score. The CVSS vector reveals this is a local privilege escalation (AV:L) requiring authenticated access (PR:L), meaning attackers must already have compromised user credentials and local system access before exploiting this vulnerability. Attack complexity is low (AC:L) with no user interaction required (UI:N), making it reliable once local access is achieved. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not being actively exploited in the wild. However, the broad attack surface spanning all Windows versions from Server 2012 through the latest Windows 11 26H1 and Server 2025 builds creates significant exposure for unpatched systems. From an SSVC perspective, technical impact is total (SYSTEM-level compromise), but exploitation requires prior foothold and is not automatable over networks. Priority should be high for servers and workstations where defense-in-depth assumes potential insider threats or lateral movement scenarios, but this is not an immediate crisis requiring emergency patching. Organizations with strong endpoint detection, least-privilege enforcement, and credential hygiene can sequence this patch within normal cycles, while high-value targets should prioritize given the complete system compromise potential.

An authenticated local user sends a specially crafted UPnP request to the Device Host service, causing it to dereference an untrusted pointer. This memory corruption enables privilege escalation to SYSTEM level without requiring user interaction.