The flaw is an untrusted pointer dereference in the Windows Universal Plug and Play (UPnP) Device Host component. An attacker who has local access can exploit the bug to corrupt memory and elevate privileges. The weakness is mapped to CWE-822, representing an access control or privilege escalation defect. The result is that a non‑privileged user can execute code with elevated rights, potentially compromising confidentiality, integrity, or availability.

Affected platforms include all current Microsoft Windows consumer releases and server editions that house the UPnP Device Host service. This comprises Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1, and the enterprise Windows Server line from Server 2012 through Server 2025, including server core installations and the 23H2 edition. The vulnerability exists in the listed operating system builds as identified in the Microsoft update advisory.

The CVSS score of 7.8 indicates high severity, and lack of an EPSS score means the exact exploitation frequency is unknown. Microsoft has not listed this incident in the KEV catalog. Because the exploit requires local, authorized access, the risk is primarily for systems where users have elevated privileges or where the UPnP Device Host service is enabled for remote control. The attack vector is inferred to be local privilege escalation, relying on manipulation of the UPnP Device Host’s internal pointers by a trusted user or process.