Microsoft EUVD-2026-22466

The vulnerability exists in the Windows Universal Plug and Play (UPnP) Device Host service (upnphost.dll), a core networking component that enables automatic device discovery and configuration on local networks. The flaw stems from CWE-822 (Untrusted Pointer Dereference), where the UPnP service improperly validates pointer references before dereferencing them. An authenticated attacker with low-level privileges can supply malicious pointer values that cause the service to dereference attacker-controlled memory locations. Since the UPnP Device Host service typically runs with elevated SYSTEM privileges, successful exploitation allows arbitrary code execution in the security context of the service, bypassing Windows privilege boundaries. The vulnerability affects the UPnP service implementation across all modern Windows platforms from legacy Server 2012 through current Windows 11 26H1 and Server 2025, indicating the flaw exists in shared codebase spanning over a decade of Windows releases.