CVE-2026-32212
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in Universal Plug and Play (upnp.dll) stems from improper link resolution before file access ('link following'). An authorized attacker can exploit this flaw to disclose information locally.
Risk Assessment
An attacker with valid credentials could read sensitive data from the system, potentially leading to leakage of confidential information.
Recommendation
Update the system to a version containing the fix for upnp.dll or restrict access to the UPnP service to trusted users only.
Other vulnerabilities in Universal Plug and Play (upnp.dll)
See all- CVE-2026-49180Medium
Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.
- CVE-2026-45635High
A type confusion vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-45599High
A use-after-free vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS