Microsoft EUVD-2026-22544

The Windows Universal Plug and Play (UPnP) Device Host service (upnphost) facilitates network device discovery and control on local networks. This vulnerability stems from a use-after-free condition (CWE-416), a memory safety defect where the service continues to reference memory after it has been deallocated. In Windows kernel and system service contexts, use-after-free vulnerabilities occur when object lifetime management fails between concurrent operations, allowing an attacker to reclaim freed memory with controlled data structures. The UPnP Device Host runs with elevated system privileges to manage network device enumeration and SSDP protocol handling. Successful exploitation requires precise timing to win the race condition (reflected in AC:H) and the ability to place malicious objects in freed memory regions, but grants full control over the compromised system. The vulnerability spans the entire modern Windows ecosystem from legacy Server 2012 (kernel 6.2) through current Windows 11 26H1 and Server 2025 (kernel 10.0.28000), indicating a long-standing architectural issue in the UPnP implementation rather than a recent regression.