CVE-2026-85375 in Windows
Summary
by MITRE • 10/14/2026
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as a use-after-free flaw within the Windows Universal Plug and Play Device Host service represents a critical security risk that enables local privilege escalation for authenticated attackers. This specific component, often referred to by its executable name upnphost.exe or associated DLLs, is responsible for managing network discovery and communication protocols on Microsoft Windows operating systems. The core technical issue stems from improper memory management practices within the UPnP service implementation. Specifically, after a pointer to a dynamically allocated object has been freed, subsequent code paths continue to reference this invalid memory address rather than nullifying it or checking its validity before access. This classic software defect allows an attacker who has already gained initial foothold on the system through valid credentials to manipulate heap memory structures and execute arbitrary code with elevated privileges, typically reaching SYSTEM level access which grants complete control over the operating environment.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they can often be exploited reliably across different versions of Windows without requiring complex race conditions or specific timing windows that plague other types of memory corruption bugs. The attacker crafts malicious UPnP requests or manipulates existing network discovery packets to trigger the deallocation sequence while ensuring that subsequent operations still hold references to the freed memory block. By carefully controlling the contents of the heap after the free operation, often through a technique known as heap spraying or targeted allocation, the attacker can overwrite function pointers or object vtables within the reused memory space. When the vulnerable code subsequently attempts to interact with this corrupted structure, it inadvertently executes attacker-controlled shellcode instead of legitimate system functions. This mechanism bypasses many standard security mitigations because the execution flow is redirected through trusted Windows binaries and services that are already running with high privileges.
The operational impact of exploiting this vulnerability is severe, as it effectively neutralizes user-level isolation protections provided by modern operating systems. Once an attacker achieves local privilege escalation via this flaw, they can install persistent backdoors, dump credential hashes from the Security Account Manager database, modify system configurations to disable security features such as Windows Defender or firewall rules, and move laterally across the network with unrestricted access. This capability transforms a low-impact account compromise into a critical infrastructure breach. The presence of Universal Plug and Play services on many enterprise endpoints further exacerbates this risk, as these services are frequently enabled by default for convenience in home and small office networks but remain active even when not strictly necessary in hardened corporate environments.
In terms of industry standard classifications, this vulnerability aligns with CWE-416, which defines Use After Free errors where a program continues to use a pointer after it has been freed leading to unpredictable behavior or security vulnerabilities. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1068 Exploitation for Privilege Escalation and specifically sub-technique T1068.002 which involves exploiting software vulnerabilities to gain higher-level permissions. The initial access vector typically falls under T1078 Valid Accounts, indicating that the attacker must first authenticate legitimately before leveraging this flaw. Defense-in-depth strategies are essential for mitigating such risks since patching alone may not be immediately available or applicable in all legacy systems.
To mitigate the risk associated with this vulnerability, organizations should prioritize applying the latest security patches released by Microsoft as soon as they become available through Windows Update or WSUS infrastructure. For environments where immediate patching is not feasible due to compatibility concerns, network segmentation strategies can significantly reduce exposure. Disabling the Universal Plug and Play Device Host service on servers and workstations that do not require UPnP functionality removes the attack surface entirely. This can be achieved via Group Policy settings or local security policies by setting the startup type of the upnphost service to disabled. Additionally, implementing strict firewall rules to block inbound traffic from untrusted networks to ports associated with UPnP services adds another layer of defense against remote exploitation attempts that might precede local privilege escalation efforts. Regular auditing of running services and disabling unnecessary network discovery features contributes to a stronger security posture aligned with CIS Benchmarks for Windows hardening.