CVE-2026-45635

HighCVSS 8.1

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

41th percentile - higher than 41% of all known CVEs

Summary

A type confusion vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.

Risk Assessment

An attacker can remotely take control of the system, potentially leading to data theft or malware installation.

Recommendation

Apply the security update provided by the system vendor. Disable the UPnP service if not required.

Other vulnerabilities in Universal Plug and Play (upnp.dll)

See all

CVE-2026-49180Medium
Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.
CVE-2026-45599High
A use-after-free vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.

Original NVD description (English source)

Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.