A use‑after‑free bug in the Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker with local access to execute code with elevated privileges. The flaw can lead to a local privilege escalation, enabling the attacker to gain full user rights or higher by exploiting the crashed memory state. The weakness is a classic use after free vulnerability, classified as CWE‑416.

Affected operating systems include Microsoft Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 editions 23H2, 24H2, 25H2, 22H3, and 26H1; and all major Windows Server releases such as 2012 (including Server Core), 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. All the listed systems run the UPnP Device Host service, which is the component vulnerable to the use‑after‑free defect.

The CVSS score of 7 indicates a medium to high severity. Because the exploit requires local, authorized access, the attack vector is local; widespread remote exploitation is not possible. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation up to this point. Nonetheless, an attacker who can tamper with a user session can elevate privileges, potentially compromising the entire system or network if the elevated account has administrative rights.