CVE-2026-45599

What it actually does

CVE-2026-45599 is a network-reachable use-after-free vulnerability in Windows Universal Plug and Play handling in upnp.dll. An unauthenticated attacker who can send crafted UPnP/SSDP traffic to an affected Windows host may be able to corrupt memory after an object has been freed, potentially redirecting execution flow and running arbitrary code in the context of the affected service process. The CVSS vector indicates network access, no privileges, and no user interaction are required, but exploitation complexity is high, meaning reliable exploitation likely depends on precise protocol state, timing, heap layout, or service behavior.

Why it matters to the business

Successful exploitation could allow an attacker with network reachability to a vulnerable Windows workstation or server to take control of the affected process, deploy malware, move laterally, steal data, or disrupt operations. The broad affected product list spans supported Windows client and server releases, so enterprises may have significant exposure if UPnP or SSDP services are enabled on endpoints or servers. Although EPSS is currently low and the vulnerability is not listed in CISA KEV, the impact is high because exploitation can lead to full confidentiality, integrity, and availability compromise on reachable systems.

How an attack unfolds

An attacker first identifies Windows systems that expose UPnP-related services, commonly through SSDP/UPnP traffic such as UDP port 1900 and related UPnP service endpoints. The attacker then sends specially crafted network messages designed to drive vulnerable code paths in upnp.dll and create a use-after-free condition. With sufficient control over heap state and message sequencing, the attacker attempts to reuse the freed memory with attacker-controlled data and redirect execution. If successful, code executes inside the vulnerable Windows service process, after which the attacker can establish persistence, run post-exploitation tooling, access local data, or pivot to other systems. Because the attack complexity is high and no public mature exploit is reported in the provided data, exploitation is expected to require careful targeting rather than simple commodity scanning at this time.

How to fix it

Apply the relevant Microsoft security update for all affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management. Prioritize internet-facing systems, systems reachable from untrusted networks, servers, and high-value workstations. If immediate patching is not possible, reduce exposure by disabling Universal Plug and Play and SSDP Discovery services where they are not required, blocking inbound UPnP/SSDP traffic from untrusted networks, and restricting UDP/1900 and related UPnP service ports such as TCP/2869 to trusted local segments only. UPnP should generally not be exposed across network boundaries or to the internet. Monitor vendor guidance for exact KBs and fixed builds because no fixed version list was provided in the input.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft security update or cumulative update that addresses this vulnerability. Validate through enterprise patch inventory, Windows Update history, Microsoft Update compliance reporting, or build/KB verification. Confirm that unnecessary UPnP-related services such as SSDP Discovery and UPnP Device Host are disabled where not operationally required. Use network scanning from representative network zones to verify that UDP/1900 and related UPnP endpoints are not reachable from untrusted networks. For compensating controls, verify firewall rules block inbound SSDP/UPnP traffic except where explicitly required.

Typical attack path

1. Scan or probe networks for Windows hosts exposing UPnP/SSDP services, especially UDP/1900 and related UPnP endpoints.
2. Confirm that the target responds to UPnP discovery or service interaction messages.
3. Send crafted UPnP/SSDP message sequences that trigger the vulnerable use-after-free path in upnp.dll.
4. Manipulate heap layout or service state to replace freed memory with attacker-controlled content.
5. Achieve code execution in the vulnerable service process if memory corruption is successfully controlled.
6. Deploy follow-on payloads, perform discovery, collect credentials or data, and attempt lateral movement.

How to detect it

Review Windows Event Logs, endpoint telemetry, crash dumps, firewall logs, NetFlow, packet captures, and EDR process telemetry for signs of attempted or successful exploitation. Focus on Application logs and Windows Error Reporting events showing crashes in svchost.exe or UPnP-related services with upnp.dll as the faulting module, especially exception code 0xc0000005. Correlate crashes with inbound UDP/1900 SSDP traffic, unusual M-SEARCH or NOTIFY floods, malformed UPnP headers, unexpected traffic from non-local networks, or repeated probes across many hosts. Investigate any unexpected process creation, script execution, credential access, or network connections spawned from service-hosting processes after UPnP-related crashes. Since no public mature exploit or named threat actor activity is provided, detection should emphasize behavioral evidence: malformed UPnP traffic followed by service instability, memory-corruption crashes, suspicious child processes, or post-exploitation activity.

• Faulting module name: upnp.dll
• Faulting application name: svchost.exe
• Exception code: 0xc0000005
• SSDP Discovery
• UPnP Device Host
• SSDPSRV
• upnphost
• UDP/1900
• TCP/2869
• M-SEARCH * HTTP/1.1
• NOTIFY * HTTP/1.1
• ST: upnp:rootdevice
• ST: ssdp:all
• MAN: "ssdp:discover"

What your security team should do

• Inventory Windows client and server systems in the affected version range and identify hosts with UPnP/SSDP services enabled or reachable.
• Patch affected systems through normal cumulative update channels, prioritizing systems exposed to untrusted networks and critical servers.
• Disable UPnP Device Host and SSDP Discovery where there is no business requirement.
• Block or tightly restrict inbound UDP/1900 and related UPnP traffic such as TCP/2869 at host firewalls, network firewalls, and segmentation boundaries.
• Hunt for suspicious UPnP/SSDP traffic spikes, malformed discovery messages, service crashes involving upnp.dll, and unexpected child processes from service-hosting processes.
• Create temporary detections for repeated crashes of svchost.exe involving upnp.dll, especially when preceded by external or unusual UDP/1900 traffic.
• Track Microsoft advisories for fixed KBs/builds and update patch compliance dashboards once exact fixed versions are published.
• Because EPSS is currently low, treat this as high-impact but not yet broadly exploited; increase urgency if exploit code, KEV listing, or threat-actor activity emerges.