A use‑after‑free flaw in the Windows Universal Plug and Play (UPnP) Device Host process permits a locally authenticated attacker to execute arbitrary code with administrative privileges. The vulnerability is a classic use‑after‑free (CWE‑416), causing the operating system to access freed memory, which can be corrupted to alter execution flow. Successful exploitation results in a privilege escalation that allows the attacker to control the compromised system.

The flaw applies to a broad range of Windows 10 releases (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server editions from 2012 through 2025, including both standard and Server Core installations. All affected operating systems run the UPnP Device Host service, which is the target of the use‑after‑free bug.

The CVSS score of 7.0 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The attack requires local authorization or the ability to influence the UPnP service, making the likely attack vector local or proxied. Given the high severity and local elevation potential, organizations should treat this as a priority risk pending the availability of vendor mitigations.