CVE-2026-32075

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Universal Plug and Play Device Host component. An attacker who already has local, low-privileged access can trigger unsafe memory reuse in the UPnP Device Host service and potentially execute code with elevated privileges, compromising confidentiality, integrity, and availability of the affected Windows system. The CVSS vector indicates local access is required, user interaction is not required, privileges are required, and exploitation complexity is high.

Why it matters to the business

Successful exploitation can turn an initial low-privilege compromise into full control of a Windows workstation or server. In business terms, this can allow attackers to disable security tooling, steal sensitive data, install persistence, move laterally, or deploy malware after they have already gained a foothold. The vulnerability affects many supported Windows client and server versions, but current exploitation urgency is moderated by low EPSS, no known KEV listing, no ransomware association, and no public exploit maturity reported in the provided data.

How an attack unfolds

An attacker first needs authenticated local access to an affected Windows system, such as through stolen credentials, malware execution, remote desktop access, or another initial-access vulnerability. The attacker then interacts with the Windows Universal Plug and Play Device Host service in a way that triggers the use-after-free condition. If the attacker can shape memory reliably despite the high attack complexity, the freed object may be reused in a controlled manner, allowing execution flow or privileged operations to be influenced. A successful exploit would elevate the attacker from a low-privileged context to a higher-privileged context, commonly enabling follow-on actions such as credential dumping, security-control tampering, service creation, scheduled task persistence, or lateral movement. No named threat actors, ransomware campaigns, KEV exploitation, or public exploit maturity were provided.

How to fix it

Apply the applicable Microsoft security updates for the affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the organization’s normal patch-management channel. Because no exact fixed build numbers were provided, validate remediation against Microsoft’s official release notes for CVE-2026-32075 and the relevant Windows 10, Windows 11, and Windows Server versions. Where immediate patching is not possible, reduce exposure by disabling the UPnP Device Host service if it is not operationally required, restricting local interactive and remote logon rights, enforcing least privilege, limiting RDP and administrative access, and ensuring endpoint detection and response controls monitor privilege-escalation behavior. Test any UPnP service changes before broad deployment because some discovery or device-integration functions may depend on UPnP.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft security update that remediates this issue for its specific Windows release and build. Validate OS build numbers and installed hotfixes using centralized patch inventory, Windows Update compliance reporting, PowerShell, WSUS, Intune, Configuration Manager, or vulnerability scanning. Confirm unsupported or unpatched Windows versions are either updated, isolated, or decommissioned. If mitigation rather than patching is used, verify the UPnP Device Host service state and startup configuration are set according to policy and that business functionality remains acceptable. Re-scan systems after patch deployment and compare results against the affected product list to ensure Windows 10, Windows 11, and Windows Server assets are no longer reported as vulnerable.

Typical attack path

1. Obtain low-privileged local access to an affected Windows workstation or server.
2. Verify the UPnP Device Host component is present and reachable on the host.
3. Trigger the vulnerable UPnP Device Host code path that mishandles a freed memory object.
4. Manipulate local process memory conditions to increase the chance that the freed object is reused in an attacker-beneficial way.
5. Achieve elevated privileges if exploitation succeeds.
6. Use the elevated context to create persistence, disable defenses, access sensitive data, or move laterally.

How to detect it

There are no CVE-specific public exploit indicators in the provided data, so detection should focus on behavioral evidence of local privilege escalation and suspicious activity around the UPnP Device Host service. Review Windows Security logs for process creation, privilege assignment, new service installation, scheduled task creation, new local administrators, and unusual logon activity. Review System logs for Service Control Manager events related to UPnP Device Host starts, stops, crashes, or unexpected configuration changes. Review Windows Error Reporting and Application logs for svchost.exe crashes around the time of privilege changes, especially when the service group includes UPnP Device Host. If Sysmon or EDR telemetry is available, hunt for unusual child processes from svchost.exe, suspicious handle access to privileged processes, token manipulation, memory injection, credential-access tools, and rapid sequences where a low-privileged process is followed by elevated command execution. Correlate any UPnP Device Host instability with subsequent administrative actions such as adding users to local administrators, creating services, modifying Defender settings, dumping LSASS memory, or lateral movement. Because exploitation requires prior local access, also examine the initial-access path: remote logons, dropped binaries, phishing payloads, software execution from user-writable directories, and anomalous use of scripting interpreters.

• upnphost
• UPnP Device Host
• svchost.exe -k LocalServiceAndNoImpersonation
• Faulting application name: svchost.exe
• Service Control Manager
• The UPnP Device Host service terminated unexpectedly
• The UPnP Device Host service entered the running state
• sc.exe start upnphost
• net start upnphost
• Add-LocalGroupMember
• net localgroup administrators
• New-Service
• schtasks.exe /Create
• powershell.exe -ExecutionPolicy Bypass
• wevtutil cl Security
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• lsass.exe

What your security team should do

• Prioritize patching internet-facing jump hosts, shared workstations, developer workstations, domain administration workstations, and high-value Windows servers, even though exploitation requires local access.
• Use centralized asset and patch inventory to identify all affected Windows 10, Windows 11, and Windows Server versions listed for this vulnerability.
• If patching must be delayed, assess whether the UPnP Device Host service is required and disable it where operationally safe.
• Harden local access paths by restricting RDP, enforcing MFA for remote access, reducing local administrator membership, and reviewing interactive logon rights.
• Monitor for post-exploitation behaviors commonly associated with local privilege escalation, including new local administrators, new services, scheduled tasks, credential-dumping attempts, EDR tampering, and unusual child processes from service-hosting processes.
• Tune detections around abnormal svchost.exe behavior involving the UPnP Device Host service, especially crashes followed by privileged process creation or security-control changes.
• Because the provided EPSS is low and stable and there is no KEV status, treat this as important defense-in-depth patching rather than an emergency internet-scale exploitation event unless new exploit intelligence emerges.