Heap-based buffer overflow in Windows UPnP Device Host allows an authorized attacker to execute code with elevated privileges. This flaw can be used to obtain full local administrative rights, compromising system confidentiality, integrity, and availability for any user who can trigger the exploit in a local context. The weakness is classified as CWE-122.

Affected Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2 (duplicate). Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025—including their Server Core variations—are also vulnerable. The flaw impacts the Device Host component responsible for handling UPnP traffic.

The CVSS score of 7.8 marks it as high severity, but the EPSS score is unavailable, so the current exploitation probability is unknown. The vulnerability is not listed in CISA's KEV catalogue, suggesting no widespread active exploitation reported. The attack vector is local and requires an authorized user or processes that can interact with the Device Host; an attacker could supply crafted UPnP requests to trigger the overflow and achieve privilege escalation.