CVE-2026-45599: Windows UPnP Device Host Remote Code Execution Vulnerability

Synopsis

A use-after-free vulnerability in the Windows UPnP Device Host service (upnp.dll) allows a remote, unauthenticated attacker to execute arbitrary code on affected systems over the network. The exploit is reachable without any credentials and requires no user interaction, though successful exploitation depends on meeting specific timing or environmental conditions due to the high attack complexity rating. Successful exploitation gives the attacker full control, enabling arbitrary code execution with the privileges of the UPnP service process. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UPnP Device Host service over the network; any system exposing upnp.dll to network traffic is in scope.

• AuthenticationNot required

  No credentials or account of any kind are needed; the vulnerability is exploitable by an unauthenticated attacker.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; exploitation is entirely attacker-driven.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for race conditions, specific memory layout states, or other environmental factors that are not fully within their control.

Blast Radius

• A successful attacker executes arbitrary code in the context of the UPnP Device Host process, potentially gaining a foothold on the host.
• Confidentiality is fully compromised: the attacker can read memory, credentials, tokens, or any data accessible to the service process.
• Integrity is fully compromised: the attacker can write or modify files, registry keys, and in-memory state accessible to the process.
• Availability is fully compromised: the attacker can crash the service or, with elevated privilege escalation steps, disrupt the broader system.