Microsoft CVE-2026-32077

Windows Universal Plug and Play (UPnP) Device Host is a core Windows service that enables automatic discovery and configuration of network devices. This vulnerability involves CWE-822 (Untrusted Pointer Dereference), where the UPnP service improperly validates memory pointers before dereferencing them. An attacker with low-privilege authenticated access can supply malicious pointer values that, when dereferenced by the privileged UPnP service, redirect execution flow or corrupt memory in a controlled manner. Because the UPnP Device Host typically runs with SYSTEM privileges, successful exploitation allows a low-privileged user to escape their security context and gain complete control over confidentiality, integrity, and availability (C:H/I:H/A:H per CVSS). The vulnerability affects the Windows networking stack across both client and server SKUs spanning over a decade of releases, from legacy Server 2012 (NT 6.2) through modern Windows 11 26H1 and Server 2025 (NT 10.0.28000/26100).