A heap‑based buffer overflow in upnp.dll allows an authorized local attacker to trigger an out‑of‑bounds write, identified as CWE‑122, and to elevate privileges on the affected Windows system. The flaw can enable execution of code with higher privileges, potentially compromising the entire machine if the attacker exploits it successfully. The impact is limited to actors who already have local access; a remote exploitation path is not described.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025, including both standard and Server Core installations.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low but non‑zero likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly available exploitation tools are known at this time. The likely attack vector requires an attacker to be present locally and have some legitimate access to the system to trigger the privilege escalation.