Microsoft Windows EUVD-2026-44297

Exploitation requires the attacker to already be authenticated on the target host with low privileges (PR:L) and to interact locally with the Windows UPnP Device Host / upnp.dll code path - there is no remote or network vector (AV:L) and no user interaction is needed (UI:N). Limiting factors: the attacker must first obtain a local foothold (standard user or an equivalent low-privilege context), and the vulnerable UPnP Device Host / SSDP Discovery service must be present and running, which is the default on the listed Windows 10/11 and Windows Server 2019-2025 builds but can be disabled. It is not exploitable by an unauthenticated remote attacker.

The signals are internally consistent and point to a real-but-not-emergency patching priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local, low-complexity attack requiring existing low-level authentication with full confidentiality, integrity, and availability impact - a classic privilege-escalation profile, not a remotely wormable bug. This aligns with a low EPSS score (0.36%, 29th percentile) and CISA's SSVC assessment of Exploitation: none, Automatable: no, Technical Impact: partial. No KEV listing and no POC mean there is no public exploit identified at time of analysis. The main caveat: SSVC calls technical impact 'partial' while CVSS rates C/I/A all High - a mild tension, but both agree the vulnerability requires a prior local foothold, so it is best treated as a second-stage escalation risk rather than an initial-access threat.

An attacker who already has a low-privileged foothold on a Windows host - for example through a compromised standard user account or a sandboxed process - invokes the local UPnP interface with crafted input that overflows a heap buffer in upnp.dll. By shaping the heap corruption, the attacker escalates from limited user to SYSTEM, then installs tooling or moves laterally. No public exploit is identified at time of analysis, and the local, low-complexity vector means exploitation is plausible for a skilled attacker who has already breached the machine.