Executive brief
A security vulnerability exists in the Microsoft Windows component responsible for Universal Plug and Play (UPnP), which allows devices on a network to discover and communicate with each other automatically. An attacker could exploit this flaw to remotely take control of a computer or disrupt its operations without needing any login credentials. This could lead to unauthorized access to sensitive data or a complete system shutdown, impacting business continuity and data security.
Technical details
This vulnerability is a use-after-free (UAF) flaw located in the upnp.dll library of the Microsoft Windows UPnP service. Although the MSRC advisory also references CWE-843 (Type Confusion), the primary mechanism involves improper memory management when handling UPnP network traffic. An unauthenticated attacker can exploit this by sending specially crafted packets over the network to a target system. Successful exploitation allows for remote code execution (RCE) in the context of the service, though the attack complexity is rated as high, likely due to timing requirements or memory layout randomization. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Universal Plug and Play (UPnP) Service
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Microsoft published the security update guide.