Windows UPnP EUVD-2026-35556

Exploitation requires network reachability to the Universal Plug and Play service on the target Windows host - typically the SSDP Discovery (SSDPSRV) and UPnP Device Host (upnphost) services listening on UDP/1900 and dynamic UPnP control endpoints - which are commonly enabled on workstations with Network Discovery turned on but generally disabled or firewalled on Windows Server and hardened enterprise builds. No authentication or user interaction is required (PR:N/UI:N), but the CVSS AC:H qualifier indicates the attacker must satisfy a non-trivial precondition, most likely winning a race condition or achieving a specific heap layout to leverage the use-after-free for code execution rather than a mere crash. Practical limiters: hosts with UPnP disabled, network segments that block UDP/1900 inbound, and exposure restricted to local broadcast domains in default configurations.

The CVSS vector AV:N/AC:H/PR:N/UI:N indicates a network-reachable, unauthenticated, no-user-interaction bug - strong indicators of wormable potential on paper - but the AC:H qualifier signals that exploitation depends on non-trivial conditions (e.g., winning a race, grooming the heap, or specific timing). Scope:Unchanged with C:H/I:H/A:H means full compromise of the affected service context if exploitation succeeds. The vulnerability is reported by Microsoft (secure@microsoft.com) and tagged for Use After Free, Memory Corruption, and DoS, suggesting the vendor judges DoS as the more reliable outcome, with RCE being harder. There is no KEV listing, no POC indicator, and no EPSS score in the provided data, so real-world exploitation pressure is currently low; however, UPnP is typically reachable on internal networks and home/edge devices, so internal lateral-movement risk should not be dismissed. Key missing data: exact affected Windows builds and patched KB numbers are not enumerated in the input - verify against the linked MSRC guide before prioritization decisions.

An attacker on the same network segment as a vulnerable Windows host sends a crafted sequence of SSDP or UPnP control messages designed to trigger the use-after-free in upnp.dll, manipulating heap state to gain control of a freed object's vtable or callback pointer. Because AC:H reflects the need to win a race or precisely groom memory, the attacker may need multiple attempts, but successful exploitation yields code execution in the context of the UPnP service. No public exploit code has been identified at time of analysis.