CVE-2026-85918
7.0HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
A local attacker with an existing account can elevate privileges to SYSTEM. They need prior local access to run code on the target Windows machine.
Root cause
A use-after-free flaw in the Windows Universal Plug and Play (UPnP) Device Host service allows arbitrary code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the official Microsoft security update for your Windows version once published, or stop and disable the UPnP Device Host service ('UPnPHost') as a workaround.
$ Stop-Service -Name 'UPnPHost' -Force; Set-Service -Name 'UPnPHost' -StartupType DisabledAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.