CVE-2026-85373
HighCVSS 7.8Summary
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with valid credentials can exploit this flaw to gain higher privileges on the system, potentially leading to control over data and configuration.
Recommendation
Install the available Microsoft security updates for Windows as soon as possible and restrict local access to trusted users.
Other vulnerabilities in Windows Universal Plug and Play (UPnP) Device Host
See all- CVE-2026-85927High
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-85918High
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-85375High
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CVE-2026-32077High
An untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS