Windows UPnP EUVD-2026-35563

Exploitation requires that the target Windows system be running the UPnP-handling components backed by upnp.dll (SSDP Discovery and/or UPnP Device Host services) and be reachable on the network paths used by UPnP/SSDP - typically UDP/1900 multicast plus the control TCP ports on the local subnet, since SSDP is link-local by design. No authentication and no user interaction are required (PR:N/UI:N), but the CVSS High attack complexity (AC:H) indicates the attacker must satisfy conditions outside their direct control, consistent with a memory-corruption bug needing reliable heap state or a timing race to weaponize. Practically, this limits realistic exploitation to attackers with LAN adjacency (or to routers/firewalls that expose UPnP to the WAN), not arbitrary internet attackers against a hardened enterprise edge.

Signals are mixed and lean toward elevated-but-not-emergency. CVSS 8.1 with AV:N/PR:N/UI:N indicates a pre-auth network-reachable RCE with high CIA impact, but AC:H tells defenders that exploitation requires conditions outside attacker control (timing windows, heap grooming, or specific target state typical of memory-corruption bugs). There is no EPSS score, no KEV entry, and no public POC referenced, which suggests the vulnerability is currently theoretical from an attacker-tooling standpoint. CWE-843 (type confusion) conflicts with the description's 'use after free' wording - defenders should treat the bug class as memory corruption generally and verify the precise primitive via the MSRC advisory. Real-world exposure depends heavily on whether the UPnP service is reachable; on hardened enterprise networks SSDP/UPnP is typically firewalled at the perimeter, so external internet-borne exploitation is unlikely, but lateral movement within a flat LAN (or via an ISP-exposed home/SMB router segment) remains a credible path.

An attacker on the same broadcast domain - for example, on a corporate guest VLAN, public Wi-Fi, or a compromised IoT device inside the LAN - sends crafted SSDP/UPnP messages to a Windows host with the UPnP services running, triggering the memory-safety flaw in upnp.dll. After winning the race or grooming the heap correctly (reflecting AC:H), the attacker gains code execution in the context of the UPnP service. No public POC is referenced in the supplied intelligence, so weaponization effort would be non-trivial.