UPnP Device Host CVE-2026-85375

Exploitation requires the attacker to already have local, interactive or programmatic access to the Windows host with at least low-level (standard user) privileges (PR:L), and the vulnerable Windows UPnP Device Host service must be present and running - it ships enabled by default across supported Windows client and server editions listed in the EUVD data. No user interaction is needed (UI:N). The key limiting factors are: (1) no remote network vector - the attacker needs an existing foothold on the machine; and (2) as a use-after-free, successful code execution may depend on winning a memory-reuse race, consistent with SSVC 'Automatable: no'. This is a post-compromise privilege-escalation condition, not a remote unauthenticated exploit.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a local, low-complexity attack that requires the attacker to already hold valid low-privileged credentials on the target host - it is a privilege-escalation primitive, not a remote entry point, so it cannot be exploited directly over the network. The 7.8 (High) score is driven entirely by the total impact triad (C:H/I:H/A:H), consistent with SSVC Technical Impact: 'total'. Crucially, the exploitation signals are low: SSVC Exploitation is 'none', the CVE is NOT on the CISA KEV list, no POC is indicated, and SSVC Automatable is 'no' (reflecting the local access and reliability challenges typical of a use-after-free race). These signals are mutually consistent - a high-impact but not-yet-exploited local EoP. Note that no EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. The 'Denial Of Service' tag is somewhat at odds with the description, which emphasizes privilege elevation; a UAF can plausibly yield both crashes and code execution, so this is not necessarily an error, but the primary documented impact is local EoP. Overall: patch on a normal prioritized cadence (it is a strong post-compromise lateral/escalation tool for an attacker who already has a foothold), but it is not a drop-everything remote-exploitation emergency.

An attacker who has already gained an unprivileged foothold on a Windows host (e.g., via phishing, a stolen low-privilege account, or a separate RCE) runs a local program that triggers the use-after-free in the UPnP Device Host service to corrupt memory and execute code with elevated (SYSTEM-level) privileges. No user interaction is required, but local access with at least low privileges is a prerequisite. No public exploit identified at time of analysis, and SSVC rates exploitation as 'none'.