EUVD-2026-99579
GHSA-9x5q-r6h6-hfxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSend crafted data to UPnP Device Host
-
ExecutionTrigger heap-based buffer overflow
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have local, authenticated low-privilege access to the host (PR:L) and the ability to reach the Windows UPnP Device Host service to deliver malformed input that corrupts the heap. The UPnP Device Host component must be present/active, which is standard on affected Windows client and server builds. Limiting factors: no remote network vector (AV:L) and no viable exploitation from an unauthenticated position - an initial foothold is a prerequisite; no user interaction is needed (UI:N). Fixed builds (e.g., 10.0.19044.7807, 10.0.26100.9711, 10.0.14393.9612 and the corresponding per-SKU builds) are not vulnerable. |
| Impact | This is a credible but not emergency-tier privilege-escalation flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and existing low-level privileges, so it is a post-compromise escalation primitive rather than an initial-access vector - consistent with the description's 'authorized attacker ... locally' wording. CISA's SSVC framework reinforces lower urgency: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (cannot be mass/worm-scaled, fitting a local EoP), even though Technical Impact is 'total' (matching C:H/I:H/A:H, i.e. full SYSTEM compromise). No EPSS score was supplied in the input, and there is no KEV listing and no POC indicator, so exploitation probability cannot be quantified from the data. Signals are internally consistent - high technical impact but constrained reach - meaning this should be patched on a normal-to-prioritized cadence (it is a full-SYSTEM gain for any low-priv foothold) but is not a drop-everything issue absent active exploitation. The affected-version list spans essentially the entire supported Windows client and server fleet, which raises aggregate exposure despite the local-only vector. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) supplies malicious input to the UPnP Device Host service to corrupt the heap and execute attacker-controlled code at SYSTEM. With AV:L/AC:L and no user interaction required, exploitation is reliable once local access exists. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows UPnP Device Host lets a locally authenticated low-privilege user corrupt heap memory inside a privileged Windows service and elevate to higher integrity/system-level privileges. Affected software spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations; exploitation requires an existing local foothold (CVSS AV:L, PR:L) but no user interaction (UI:N), and successful triggering yields high confidentiality, integrity and availability impact. Per CISA's SSVC assessment exploitation is none and the issue is not automatable, and no public exploit code has been identified at time of analysis, so this is a credible but not emergency-tier privilege-escalation flaw that should be fixed on a normal patch cycle; fixed builds such as 10.0.19044.7807, 10.0.26100.9711 and 10.0.14393.9612 are not vulnerable.
RemediationAI
The primary fix is the vendor-released Microsoft security update; per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85927, apply the applicable cumulative update for each SKU to reach or exceed the fixed builds, including 10.0.14393.9612 (Server 2016 / Windows 10 1607), 10.0.17763.9376 (Server 2019 / Windows 10 1809), 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2) and 10.0.26100.33650 (Server 2025), 10.0.26200.9711 (Windows 11 25H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.26300.9711 (Windows 11 26H2), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2); deployment through Windows Update, WSUS, or Microsoft Update Catalog is appropriate, and legacy platforms such as Server 2012/2012 R2 may require ESU entitlement. Where immediate patching is not possible, the most effective compensating control is to stop and disable the UPnP Device Host service (upnphost) - and, if UPnP is not otherwise required, the associated SSDP Discovery service (SSDPSRV) - which removes the attack surface entirely but has the side effect of breaking UPnP device publication/discovery, network discovery and some media-streaming or IoT-style scenarios, and must be validated against application dependencies before wide rollout; restricting inbound and loopback reachability to UPnP endpoints (SSDP UDP 1900 and UPnP HTTP TCP 2869, typically on the UPnP host's loopback/interface addresses) reduces reachability but is only a partial control here, because the attacker profile is already local. Because exploitation requires an existing authenticated low-privilege foothold rather than remote or unauthenticated access, reducing the number of untrusted local interactive accounts and tightly controlling who can log on locally to the affected hosts meaningfully lowers exposure while patching proceeds; these mitigations are compensating measures only and should be removed once the fixed builds above are installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, in the Windows Universal Plug and Play (UPnP) Device Host component. UPnP Device Host implements the device side of the UPnP stack: it advertises hosted devices and services, serves device and service description documents, and handles SOAP-style control and eventing traffic, typically interacting with SSDP Discovery (UDP 1900) and UPnP HTTP endpoints such as TCP 2869. The vulnerable code path processes attacker-supplied input in a service that runs with elevated privileges, and because the size handling on a heap allocation is not correctly validated, malformed input can overwrite adjacent heap structures and enable controlled memory corruption and subsequent code execution in the service's security context. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and the independent assessment agree that this is a local privilege-escalation primitive rather than a remote one: the attacker must already hold an authenticated low-privilege session and be able to reach the UPnP Device Host functionality, but needs no user interaction and no race or unusual preconditions, hence AC:L. CISA's SSVC decision data records Exploitation: none, Automatable: no and Technical Impact: total, meaning the impact of a successful trigger is severe (full loss of confidentiality, integrity and availability on the host) but the barrier of an existing local foothold keeps aggregate risk below emergency tier. The component ships by default on the affected client and server SKUs enumerated in the EUVD data.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local heap overflow in a Windows service exploitable by an existing low-privileged user (AV:L/PR:L), no user interaction, yielding full SYSTEM compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A heap-based buffer overflow in the Windows UPnP Device Host service allows a user who already has a local login on a Windows machine to escalate to system-level privileges, affecting the full supported Windows client and server estate including Server Core builds. Because exploitation requires an existing local foothold and no public exploit code has been identified at time of analysis, this is a serious but manageable privilege-escalation risk rather than an emergency. Leadership should care because a compromised standard user account - a common outcome of phishing - could be parlayed into full control of the host, and unmanaged or deferred patching across Windows 10, Windows 11, and Server 2012 through 2025 leaves that path open.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB