CVE-2026-45635

What it actually does

This is a network-reachable use-after-free vulnerability in Windows Universal Plug and Play handling in upnp.dll. A remote, unauthenticated attacker who can send specially crafted UPnP/SSDP traffic to an affected Windows host may be able to corrupt process memory and execute arbitrary code. Successful exploitation could provide code execution in the context of the vulnerable service or process handling UPnP traffic, with potential confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required, but attack complexity is high, meaning reliable exploitation may require precise timing, heap shaping, or environmental conditions.

Why it matters to the business

If exploitable in an environment, this flaw could allow an attacker on an exposed or adjacent network to compromise Windows workstations or servers without credentials. That can lead to malware deployment, lateral movement, data theft, service disruption, or use of compromised systems as footholds. Because UPnP is commonly unnecessary on servers and enterprise endpoints, exposed UPnP services increase avoidable operational risk. This vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at this time, but the impact is high enough to prioritize patching and exposure reduction for systems where UPnP/SSDP is reachable.

How an attack unfolds

An attacker first identifies Windows systems where UPnP or SSDP-related services are reachable, commonly over local or routed network paths that permit UDP/1900 or related UPnP traffic. The attacker then sends crafted UPnP messages designed to trigger incorrect object lifetime handling in upnp.dll. By manipulating message sequence, timing, and memory layout, the attacker attempts to cause the target process to reuse freed memory in a controlled way. If successful, the memory corruption can be converted into arbitrary code execution. After gaining execution, the attacker would typically establish persistence, execute discovery commands, disable defenses, harvest credentials, or pivot to other internal systems.

How to fix it

Apply the relevant Microsoft security update or latest cumulative update for each affected Windows version as soon as it is available and validated. In the absence of explicit fixed-version details, treat fully updated supported Windows 10, Windows 11, and Windows Server systems as the remediation target and confirm patch applicability through Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Update Catalog. Where UPnP is not required, reduce exposure by disabling the SSDP Discovery service and UPnP Device Host service, blocking inbound UDP/1900 and other UPnP-related traffic at host and network firewalls, and preventing UPnP from being reachable from untrusted networks. Do not expose UPnP across WAN, VPN, guest, or internet-facing segments unless there is a documented business requirement. Segment systems that require UPnP and monitor them closely.

How to confirm the fix worked

Confirm affected systems have installed the applicable Microsoft cumulative/security update and have rebooted where required. Validate that upnp.dll is at the expected patched file version according to Microsoft update metadata for the specific Windows build. Check service state for SSDP Discovery and UPnP Device Host and verify they are disabled where not required. Use network scanning or firewall validation to confirm UDP/1900 and other UPnP traffic are not reachable from untrusted segments. Review endpoint configuration baselines to ensure Windows Firewall or equivalent controls block unsolicited UPnP/SSDP traffic. For systems that must keep UPnP enabled, perform controlled internal testing to confirm only authorized network segments can reach the service.

Typical attack path

1. Identify Windows endpoints or servers with UPnP/SSDP services reachable over the network.
2. Send UPnP/SSDP probes or crafted packets to confirm the service is active and responsive.
3. Deliver maliciously crafted UPnP traffic intended to trigger the use-after-free condition in upnp.dll.
4. Shape or influence process memory to gain reliable control of execution flow.
5. Execute attacker-controlled code in the context of the vulnerable process or service.
6. Deploy follow-on tooling for persistence, credential access, lateral movement, or data theft.

How to detect it

Look for evidence of suspicious UPnP/SSDP traffic followed by process crashes, service restarts, unusual child processes, or post-exploitation activity. Relevant sources include Windows Event Logs, Windows Error Reporting, Sysmon, EDR telemetry, firewall logs, NetFlow, packet captures, and IDS/IPS alerts for SSDP/UPnP. Investigate Windows Application log Event ID 1000 or WER Event ID 1001 entries where the faulting module is upnp.dll, especially when preceded by bursts of UDP/1900 traffic, malformed SSDP requests, or UPnP NOTIFY/M-SEARCH activity from unusual hosts. Hunt for abnormal execution chains where services associated with SSDP Discovery or UPnP Device Host are followed by command shells, PowerShell, script interpreters, credential dumping tools, or outbound network connections. Because no widely known public exploit or campaign is indicated, detection should focus on behavioral anomalies rather than a single definitive payload signature.

• Faulting module name: upnp.dll
• C:\Windows\System32\upnp.dll
• C:\Windows\SysWOW64\upnp.dll
• Event ID 1000
• Event ID 1001
• SSDPSRV
• SSDP Discovery
• upnphost
• UPnP Device Host
• UDP/1900
• M-SEARCH * HTTP/1.1
• NOTIFY * HTTP/1.1
• ST: upnp:rootdevice
• USN: uuid:
• LOCATION: http://

What your security team should do

• Prioritize patching supported Windows workstations and servers where UPnP/SSDP is enabled or reachable from broad network segments.
• Disable SSDP Discovery and UPnP Device Host on servers and managed endpoints unless there is a documented operational dependency.
• Block UDP/1900 and UPnP-related traffic between untrusted network zones, guest networks, VPN pools, and server networks.
• Inventory systems listening for or responding to UPnP/SSDP traffic and reduce exposure through segmentation and firewall policy.
• Create detections for crashes or abnormal behavior involving upnp.dll, SSDPSRV, and UPnP Device Host, especially following bursts of SSDP traffic.
• Monitor vulnerability intelligence for public proof-of-concept code, EPSS increases, KEV listing, or ransomware/criminal exploitation reports, and escalate patch urgency if exploitation activity emerges.