UPnP Device Host EUVD-2026-99577

Exploitation requires the UPnP Device Host service to be present and reachable on the target, and the attacker must already hold a local authenticated low-privileged account (PR:L) on the affected Windows system - remote or unauthenticated access does not apply (AV:L). Success is further limited by a high-complexity race condition (AC:H): the attacker must reliably win the timing window to reuse the freed object, making exploitation non-deterministic and harder on patched/hardened or single-user systems. No user interaction by a victim is needed (UI:N). The limiting factors - required local foothold, authentication, and race-condition timing - meaningfully reduce realistic risk below what the 7.0 base score alone suggests.

This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local privilege-escalation requiring the attacker to already be an authenticated low-privileged user (PR:L) and to win a difficult-to-trigger race condition (AC:H), which is typical of CWE-416 use-after-free flaws. Impact is high across confidentiality, integrity and availability (full SYSTEM-level compromise on success), but the local-only vector and high attack complexity substantially temper real-world exploitability. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or imminent exploitation - this reads as a defense-in-depth patch rather than an emergency. Note a signal tension: the attached tags include 'Denial Of Service', yet the CVSS impact and description point to privilege elevation, not availability loss alone; treat the DoS label as a secondary consequence of memory corruption rather than the primary outcome. Because the flaw affects a near-ubiquitous platform (Windows), aggregate exposure is enormous even though per-host exploitation is non-trivial; prioritize patching on multi-user and shared systems where untrusted local accounts exist.

An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) interacts with the UPnP Device Host service to trigger a use-after-free during a specific timing window. By grooming heap memory and winning the race, the attacker reuses the freed object to hijack execution flow and elevate to SYSTEM privileges. No public exploit code was identified at time of analysis, and the high attack complexity means reliable exploitation requires precise timing.