A use after free vulnerability in the Windows UPnP Device Host allows local, authenticated attackers to escalate privileges to a higher level of authority.

This is a use after free flaw (CWE-416) within the Windows UPnP Device Host component. The vulnerability requires the attacker to have low-level local privileges to trigger the flaw and achieve local privilege escalation.

The ability for a standard user to elevate their privileges to a higher level poses a significant security risk, as it effectively bypasses standard access control mechanisms. With a CVSS score of 7.8, this vulnerability is considered High severity, as it enables an attacker to perform unauthorized administrative actions, install malicious software, or compromise sensitive data stored on the host system.

Immediate Action: Apply the April 2026 security updates provided by Microsoft to the affected Windows versions listed in the advisory.

Proactive Monitoring: Review system logs for unusual process execution or attempts to access restricted system files by standard user accounts.

Compensating Controls: Ensure the principle of least privilege is strictly enforced across the environment to limit the number of users capable of initiating local processes that could interact with the UPnP service.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete local privilege escalation, organizations must prioritize the deployment of the security updates provided by Microsoft. Administrators should verify that all affected Windows endpoints are patched to the build versions identified as fixed to eliminate this vector for system compromise.