CVE-2026-32077
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
An untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with appropriate permissions may gain elevated privileges on the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update the system to the latest version to mitigate this vulnerability and to monitor access to UPnP.
Other vulnerabilities in Windows Universal Plug and Play (UPnP) Device Host
See all- CVE-2026-85927High
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-85918High
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-85375High
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-85373High
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-27925Medium
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over an adjacent network.
Original NVD description (English source)
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS