CVE-2026-58547

What it actually does

CVE-2026-58547 is a heap-based buffer overflow in the Windows Universal Plug and Play component, upnp.dll. A locally authenticated, low-privileged attacker can trigger unsafe memory handling in the UPnP service/component without user interaction. The published CVSS vector indicates local access, low attack complexity, low privileges required, and high availability impact; the description also notes potential local privilege escalation. In practice, exploitation may cause the hosting service process to crash and, depending on exploit reliability and platform mitigations, may be used to influence execution flow within the affected local service context.

Why it matters to the business

Successful exploitation can let a user or malware already present on a Windows system disrupt UPnP-related services and potentially gain elevated local capabilities. This is most relevant for endpoint and server hardening because it can be used after initial access to strengthen an attacker’s foothold, impair system availability, or chain with other vulnerabilities. The issue affects multiple supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so remediation should be prioritized through normal patch management unless exposure patterns or local threat activity increase urgency.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows host, such as through compromised credentials, malware execution, or interactive access. The attacker then runs a crafted local program or command sequence that interacts with the Universal Plug and Play component in a way that causes malformed data to be processed by upnp.dll. The vulnerable code path mishandles heap memory, resulting in a buffer overflow. The most likely observable outcome is a crash of the hosting service process and related UPnP functionality. If an exploit can reliably bypass platform memory protections, the same condition may be leveraged as part of a local privilege-escalation chain. Because the attack is local and requires prior access, exploitation is most likely to appear as post-compromise activity rather than internet-facing exploitation.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-58547 for all affected Windows versions: Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative update for the affected operating system release. Where immediate patching is not possible, reduce local attack opportunities by limiting interactive logon rights, enforcing least privilege, blocking untrusted local code execution, monitoring service crashes, and disabling UPnP-related services only where operationally safe and validated.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft cumulative update that includes the fix for this vulnerability. Validate through Windows Update history, enterprise patch-management compliance reports, or PowerShell inventory of installed hotfixes and OS build numbers. Confirm that vulnerable systems are no longer pending applicable security updates. If a temporary mitigation such as disabling UPnP-related services was used, verify the service state and confirm that business functionality is not impaired. Security teams should also validate that endpoint detection controls capture local process creation, service crashes, Windows Error Reporting events, and suspicious execution around UPnP-related components.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Identify that the system is running a vulnerable Windows version with the UPnP component present.
3. Execute a crafted local payload or tool that invokes the vulnerable UPnP code path in upnp.dll.
4. Trigger heap memory corruption in the service process that loads the UPnP component.
5. Cause denial of service by crashing the affected service, or attempt to shape memory corruption for local privilege escalation.
6. Use any gained elevated context or service disruption to continue post-exploitation activity.

How to detect it

To determine whether this was already exploited, review endpoint telemetry and Windows logs for local execution followed by UPnP-related crashes. Useful sources include Windows Event Log, System log service-control events, Application log crash events, Windows Error Reporting, EDR process creation telemetry, Sysmon process and image-load events, PowerShell logs, and service state-change records. Look for faulting-module entries naming upnp.dll, crashes of svchost.exe hosting UPnP-related services, unexpected stops or restarts of UPnP Device Host or SSDP Discovery, and repeated application-error events clustered around suspicious local process execution. Investigate binaries launched from user-writable locations shortly before the crash, especially newly created executables, scripts, or tools that interact with Windows services or COM interfaces. Because no public exploit indicators or named threat actors were provided, detection should focus on behavioral evidence: local low-privileged process execution, malformed-service interaction, service crash, restart, and any subsequent privilege or token changes.

• Faulting module name: upnp.dll
• Faulting application name: svchost.exe
• UPnP Device Host
• SSDP Discovery
• upnphost
• SSDPSRV
• The UPnP Device Host service terminated unexpectedly
• The SSDP Discovery service terminated unexpectedly
• Windows Error Reporting
• Application Error
• svchost.exe -k LocalServiceAndNoImpersonation
• upnp.dll

What your security team should do

• Deploy the applicable Microsoft security update to affected Windows desktop and server versions through standard patch-management channels.
• Prioritize systems where untrusted users can log on locally, shared workstations, jump hosts, VDI hosts, terminal servers, and servers with broad interactive access.
• Review local administrator membership, interactive logon permissions, and application control policies to reduce the ability of low-privileged users or malware to execute local exploit tooling.
• Monitor for repeated crashes involving upnp.dll, UPnP Device Host, SSDP Discovery, or svchost.exe service groups associated with UPnP functionality.
• Hunt for suspicious local process execution immediately preceding UPnP-related service crashes, especially from temporary, user-writable, download, archive-extraction, or scripting directories.
• Do not treat this as an internet-facing remote code execution issue; focus detection on post-compromise local activity and privilege-escalation attempts.
• Track Microsoft advisories for exact fixed build numbers and any change in exploit maturity, KEV status, or observed exploitation.