Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Windows UPnP Device Host Privilege Elevation Vulnerability

CVE-2026-27915
Summary

An attacker with authorized access to a Windows system can exploit a vulnerability in the Universal Plug and Play (UPnP) Device Host service, allowing them to gain elevated privileges on the system. This could potentially lead to unintended actions or unauthorized access to system resources. To protect your system, ensure that the UPnP service is disabled unless necessary, and consider implementing additional access controls.

Original title
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Original description
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
nvd CVSS3.1 7.8
Vulnerability type
CWE-416 Use After Free
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026