CVE-2026-45599
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A use-after-free vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.
Risk Assessment
An attacker can remotely take control of the system, potentially leading to data theft or malware installation.
Recommendation
Apply the security update provided by the system vendor. Disable the UPnP service if not required.
Other vulnerabilities in Universal Plug and Play (upnp.dll)
See all- CVE-2026-49180Medium
Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.
- CVE-2026-45635High
A type confusion vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.
Original NVD description (English source)
Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.