EUVD-2026-22459
GHSA-rhgr-5jwv-9hcr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation via use-after-free memory corruption in Windows Universal Plug and Play (UPnP) Device Host affects all supported Windows versions from Server 2012 through Windows 11 26H1. Authenticated local attackers with low privileges can exploit this CWE-416 flaw to gain SYSTEM-level access with low attack complexity (CVSS:3.1 AV:L/AC:L/PR:L). Vendor-released patches are available across all affected Windows 10, Windows 11, and Windows Server product lines. No public exploit code
Technical ContextAI
The vulnerability resides in the Windows Universal Plug and Play (UPnP) Device Host service, a system component responsible for discovering and controlling network-connected UPnP devices. This is a use-after-free memory corruption issue (CWE-416), occurring when the UPnP service attempts to reference memory that has already been deallocated. In Windows architecture, UPnP Device Host typically runs with elevated privileges to manage network device enumeration and SSDP protocol handling. The use-after-free condition allows an attacker to manipulate freed memory structures before reallocation, potentially redirecting code execution flow. The vulnerability affects the upnphost.dll component across Windows kernel versions from 6.2.9200 (Server 2012) through 10.0.28000 (Windows 11 26H1), spanning over a decade of Windows releases. The local attack vector requirement and low privilege baseline suggest the flaw exists in an interface accessible to standard authenticated users rather than requiring administrative context.
RemediationAI
Apply Microsoft security updates immediately through Windows Update or WSUS to upgrade to patched builds: Windows 10 1607 to 10.0.14393.9060 or later, Windows 10 1809 to 10.0.17763.8644 or later, Windows 10 21H2/22H2 to 10.0.19044.7184/10.0.19045.7184 or later, Windows 11 22H3/23H2 to 10.0.22631.6936 or later, Windows 11 24H2 to 10.0.26100.32690 or later, Windows 11 25H2 to 10.0.26200.8246 or later, Windows 11 26H1 to 10.0.28000.1836 or later, Server 2012 to 6.2.9200.26026 or later, Server 2012 R2 to 6.3.9600.23132 or later, Server 2016 to 10.0.14393.9060 or later, Server 2019 to 10.0.17763.8644 or later, Server 2022 to 10.0.20348.5020 or later, Server 2022 23H2 to 10.0.25398.2274 or later, and Server 2025 to 10.0.26100.32690 or later. As a temporary mitigation where patching is delayed, disable the UPnP Device Host service (upnphost) if UPnP device discovery is not required, though this may impact network device enumeration and media streaming functionality. Detailed patch deployment guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today