CVE-2026-49180

MediumCVSS 5.5

Published: 14/07/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Improper link resolution before file access in Universal Plug and Play (upnp.dll). Allows an authorized attacker to disclose information locally.

Risk Assessment

An attacker could access sensitive files, potentially leading to data leakage.

Recommendation

Install security updates for the UPnP component from Microsoft.

Other vulnerabilities in Universal Plug and Play (upnp.dll)

See all

CVE-2026-45635High
A type confusion vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.
CVE-2026-45599High
A use-after-free vulnerability in the Universal Plug and Play component (upnp.dll) allows an unauthorized attacker to execute code remotely over a network.

Original NVD description (English source)

Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.