Windows UPnP EUVD-2026-44047

Exploitation requires a valid local user account with at least standard (low-privilege) access to the target Windows system, as indicated by PR:L in the CVSS vector. The attacker must be able to execute code locally, either through an interactive session, Remote Desktop, or a previously established foothold. The UPnP service (SSDP Discovery / UPnP Device Host) must be running, which is the default configuration on Windows desktop editions but may be disabled on hardened server builds. Exploitation is strictly local (AV:L) - no remote unauthenticated attack path is indicated by the CVSS vector or description. Limiting factors include the requirement for a valid local account and the absence of any integrity or availability impact, making this most relevant as a component of a multi-stage attack chain rather than a standalone critical compromise.

The CVSS 3.1 base score of 5.5 (Medium) reflects the local attack vector (AV:L) and low-privilege requirement (PR:L), which substantially limits the exploitable population compared to a network-reachable flaw. The Confidentiality impact is rated High (C:H), meaning successful exploitation could expose significant memory contents, but there is no integrity or availability impact (I:N/A:N). No EPSS score was provided in the available intelligence, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation. No public proof-of-concept code has been identified at time of analysis. The real-world risk is therefore moderate: the flaw is meaningful for multi-tenant or shared Windows environments (e.g., terminal servers, developer workstations with untrusted users) where an authenticated local user could leverage memory disclosure for privilege escalation chains, but it is not an immediate remote threat. The absence of scope change (S:U) further bounds the blast radius to the local system.

A standard Windows user account logs in locally or via Remote Desktop to an affected Windows system, then executes crafted code that invokes UPnP APIs exposed through upnp.dll. The call triggers the uninitialized memory read path, and the attacker reads the returned buffer containing stale memory - potentially exposing credentials, session tokens, or encryption keys previously resident in that memory region.