CVE-2026-45635: Windows UPnP Device Host Remote Code Execution Vulnerability

Synopsis

Use-after-free in the Windows UPnP Device Host service (upnp.dll) allows a remote, unauthenticated attacker to execute arbitrary code on affected Windows systems over the network. The vulnerability is reachable without any credentials and requires no user interaction, though exploitation involves meaningful technical complexity due to memory layout requirements. Successful exploitation gives the attacker full control over the affected host, including the ability to read, modify, or destroy data and disrupt running services. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UPnP Device Host service over the network; no local access or physical presence is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable code path is exposed to unauthenticated network requests.

• Victim interactionNot required

  Exploitation is fully silent and requires no action from any user on the target system.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must overcome memory layout constraints or timing conditions inherent in triggering the use-after-free reliably.

Blast Radius

• A successful attacker executes arbitrary code in the context of the UPnP Device Host service, gaining a foothold on the host.
• With code execution established, the attacker reads files and in-memory secrets accessible to the service account, including stored credentials or session data.
• The attacker modifies or deletes files and registry entries reachable by the compromised process, enabling persistence or sabotage of host configuration.
• The attacker terminates or destabilizes the UPnP service and any dependent services, causing a loss of availability for those components.