A use‑after‑free vulnerability in the Windows Universal Plug and Play (UPnP) Device Host enables an attacker to read memory that the host system has already freed, exposing data it otherwise holds. The flaw does not lead to code execution; it merely leaks sensitive information such as configuration settings or internal state that could assist a subsequent attack.

Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through 2025, including Server Core installations. All affected systems run the UPnP Device Host service, typically enabled by default.

The CVSS base score of 6.5 indicates moderate severity. No EPSS data or KEV listing is available, so widespread exploitation has not been observed. The attack requires an attacker to be on the same local network to send crafted UPnP packets, limiting the attack surface but still allowing a compromised local host to read protected information and potentially support lateral movement.