Microsoft Windows UPnP Device Host Privilege Escalation Vulnerability

A use-after-free vulnerability has been identified in the Windows Universal Plug and Play (UPnP) Device Host. This vulnerability allows an authorized attacker to elevate privileges on a system, potentially gaining SYSTEM privileges, from an adjacent network.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain elevated rights on the affected system.

Remediation

Users can apply the security updates provided in the July 2025 Monthly Rollup for their respective Windows Server versions. Details on these updates can be found in the Microsoft Knowledge Base articles KB5062597, KB5062592, KB5062632, KB5062624, and KB5062618.