Use after free in the Windows Universal Plug and Play (UPnP) Device Host component allows a local user to obtain higher privileges on the system. The flaw occurs when the device host code dereferences a freed memory reference, enabling the attacker to execute arbitrary code or manipulate system state. The impact is an elevation of privilege, allowing the attacker to gain full control of the affected machine if they have local access.

Affected systems include Microsoft Windows 10 with build versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 with build versions 23H2, 24H2, 25H2, 26H2, and the ARM64-based 26H2; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, along with their Server Core installations.

CVSS indicates a high severity with a score of 7.8. The vulnerability is local, requiring an authorized user to exploit the use‑after‑free in UPnP Device Host. EPSS is not available, and the flaw is not listed in CISA KEV, suggesting no widespread exploitation as of now. However, the attack vector is local privilege escalation, so any user with local access could potentially obtain full administrative rights. Organizations that allow UPnP to run or have unrestricted local accounts should urgently address the issue.