Windows UPnP Device Host: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Universal Plug and Play (UPnP) Device Host allows an authorized local attacker to elevate privileges. Successful exploitation gives full control over the affected system (high impact on confidentiality, integrity and availability). The attacker needs a low-privileged account or foothold on the system, and no user interaction is required. The vulnerability is not directly reachable from the internet according to the CVSS vector.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 (6.2.9200.0 to < 6.2.9200.26434), including Server Core
• Windows Server 2012 R2 (6.3.9600.0 to < 6.3.9600.23470), including Server Core
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2 and 25H2: 10.0.26100.9711 / 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

Fixed in Microsoft's October 2026 security update. The KB numbers were not confirmed; check the MSRC advisory.

Workaround

Unknown. No vendor-published workaround was found.

• Optional, not confirmed by the vendor: if the UPnP Device Host service is not required on a system, stop and disable it until the update is installed.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability rated 'Exploitation Less Likely'.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS approx. 0.003 (below 1%).
• No public proof of concept or in-the-wild exploitation known.

Our recommendation

• Install the October 2026 Windows security update on all affected systems, prioritising multi-user systems, terminal servers (RDS) and any Windows 10 1607 systems.
• Verify that Windows 10 1607 systems still receive security updates (LTSB); if not, plan an upgrade.
• If the UPnP Device Host service is not needed, disable it.
• Include this update in the normal monthly patch cycle and monitor for exploitation reports.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85927 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-85927 vulners.com
• OpenCVE: CVE-2026-85927 app.opencve.io
• VulDB: CVE-2026-85927 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:43.