A use‑after‑free vulnerability exists in Windows Universal Plug and Play (UPnP) Device Host. The flaw, a classic CWE‑416 use‑after‑free, allows an attacker who can execute code in the context of the UPnP service to manipulate dangling memory and gain elevated local privileges. The vulnerability is triggered when the service frees an object but fails to zero out or invalidate subsequent references, enabling the attacker to craft a malicious allocation that reuses the freed memory. Successful exploitation results in local privilege escalation and the ability to run code with system rights.

Microsoft Windows 10 builds 1607, 1809, 21H2, 22H2; Windows 11 builds 23H2, 24H2, 25H2, 22H3, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 are impacted. The affected architectures include x86, x64, and arm64 across these releases.

The CVSS base score of 7.8 indicates high severity, but Microsoft has not released an EPSS score and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. The attack vector is local; an attacker must already have some level of user‑level access to run code that targets the UPnP Device Host. Based on the description, the vulnerability can be exploited by malware or privileged users to elevate to system level until a patch is applied.