UPnP Device Host CVE-2026-85373

Exploitation requires local code execution on the target host as an already-authenticated low-privileged user (CVSS PR:L, AV:L) and requires the Windows UPnP Device Host service to be running and reachable by the attacker's process. There is no remote vector and no user interaction is needed (UI:N). The primary limiting factors are the need for a pre-existing authenticated local foothold and the presence/activation of the UPnP Device Host service, which is not always in use in hardened or server environments; this makes the flaw a privilege-escalation stage rather than an initial-access vector.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates an attacker needs local access and must already hold low-level privileges (PR:L), but attack complexity is low and no user interaction is required, yielding full confidentiality, integrity, and availability impact on the host. Multiple signals converge toward a moderate, non-urgent priority rather than an emergency: CISA's SSVC decision framework reports Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that cannot be sprayed at scale), and Technical Impact=total (consistent with C:H/I:H/A:H and the 'total' system compromise a heap overflow in a host service can yield). There is no EPSS score, no KEV listing, and no public POC in the provided data, so exploitation probability signals are absent rather than low. The description's 'authorized attacker' phrasing aligns with the CVSS PR:L requirement, so the signals are internally consistent and not conflicting. Net: a genuine but not drop-everything issue - a privilege-escalation primitive valuable as a second stage after an attacker already has a foothold, not a remotely-wormable threat. Note that EPSS data is entirely missing from the input, so probabilistic exploitation likelihood could not be weighed.

An attacker who has already obtained a low-privileged foothold on a Windows host (e.g., via phishing or a prior vulnerability) runs a crafted program that sends malformed data to the UPnP Device Host service, triggering the heap-based buffer overflow to corrupt memory and execute code in a higher-privileged context. No user interaction is required once local access exists. No public exploit code was identified at the time of analysis, so this would require original exploit development.