Microsoft Universal Plug and Play Information Disclosure Vulnerability

A vulnerability in Universal Plug and Play (UPnP) within the 'upnp.dll' file allows an authorized attacker to locally disclose information. This issue arises from the use of uninitialized resources, which could enable a non-administrator attacker to read files accessible to the UPnP Device Host Service. The vulnerability affects several versions of Windows, including various releases of Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, as well as Windows Server 2012 R2 and 2025 Server Core installations.

Impact

Exploitation of this vulnerability could lead to unauthorized local information disclosure.

Remediation

Users can apply the security update for this vulnerability, which is included in the July 2026 Monthly Rollup, available through the Microsoft Update Catalog.