Product:
Windows Universal Plug and Play
Summary
Untrusted pointer dereference in Windows Universal Plug and Play Device Host allows an authorized attacker to elevate privileges locally. This vulnerability can lead to significant security risks if exploited. It is crucial for users to be aware of the potential impacts of this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-32077 |
Exploitation
To exploit this vulnerability, an attacker with local access can manipulate the UPnP Device Host to dereference an untrusted pointer. This can lead to privilege escalation, allowing the attacker to gain higher-level access to the system. The attack requires low complexity and does not necessitate user interaction, making it a significant threat.
Affected Products
- Windows Universal Plug and Play Device Host: Vulnerable to untrusted pointer dereference, allowing local privilege escalation.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Users should ensure their systems are up to date and follow best security practices to minimize the risk of exploitation.