Microsoft Windows UPnP Device Host: Use after free allows local privilege escalation

Summary

A use-after-free weakness (CWE-416) in the Windows Universal Plug and Play (UPnP) Device Host allows an authorized local user to elevate privileges. The attacker needs local access and a low-privileged account first; the vulnerability is not reachable remotely over the network. Microsoft rates it Important with a CVSS 3.1 base score of 7.8.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: before 10.0.17763.9376
• Windows 10 Version 21H2: before 10.0.19044.7807
• Windows 10 Version 22H2: before 10.0.19045.7807
• Windows 11 Version 23H2: before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: before 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711 respectively
• Windows 11 Version 26H1: before 10.0.28000.3231
• Windows Server 2012 (incl. Server Core): before 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): before 6.3.9600.23470

Fixed in

• Apply the October 2026 Microsoft security update for your Windows build. Fixed build numbers: see the affected list above and verify them in the MSRC Security Update Guide, as third-party trackers disagree on some ranges.

Workaround

• No official Microsoft workaround known.

Exploitation

• CISA SSVC: Exploitation none, not automatable, total technical impact.
• Microsoft exploitability rating: E:U (unproven exploit code).
• Not listed in the CISA KEV catalog according to a secondary source (not verified directly).
• No public proof of concept found. Status treated as unknown rather than confirmed absent.

Our recommendation

• Patch affected Windows systems as a priority, especially shared workstations, terminal servers and file servers with many local users.
• Verify support status and patch level of Windows 10 1607, Windows Server 2012 and 2016 systems; isolate those that cannot be patched.
• Check the MSRC Security Update Guide for the exact fixed build of your version.
• Monitor for unusual privilege changes and UPnP Device Host activity in event logs.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• VulDB vuldb.com
• Vulners CVE record vulners.com
• Strix CVE record www.strix.ai
• OffSeq threat radar radar.offseq.com
• OpenCVE app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:13.