Windows Server 2012 EUVD-2026-22463

Local user account required with logon access to the system; Windows UPnP Device Host service must be running (default on Windows with UPnP enabled); attacker must have ability to interact with UPnP service locally.

Real-world risk assessment reveals moderate-to-high practical severity despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low privileges required but low attack complexity and no user interaction needed, making this exploitable by any authenticated user once technique details emerge. The scope is unchanged (S:U), meaning the vulnerability cannot escape its security context, limiting impact to the local system. Microsoft's patch release without KEV listing or public POC suggests this was responsibly disclosed and remediated before active exploitation. The requirement for initial local access (PR:L) significantly reduces exposure compared to network-accessible vulnerabilities, as attackers must first compromise a user account through separate means. However, in enterprise environments with numerous low-privilege users or in post-compromise scenarios, this becomes a reliable escalation primitive. The complete impact triad (C:H/I:H/A:H) means successful exploitation grants full system control, making this critical for defense-in-depth strategies. Organizations already compromised by initial access malware should prioritize patching given the reliable escalation path this provides to attackers already inside the network perimeter.

An attacker who has gained initial access to a Windows system through phishing, stolen credentials, or software vulnerability establishes a standard user session with low privileges. The attacker then runs a malicious program that interacts with the Windows UPnP Device Host service, passing crafted data containing manipulated pointer