Upnp — CraftedSignal Threat Feed

CVE-2026-27916 Use-After-Free in Windows UPnP Device Host

hello@craftedsignal.io — Wed, 15 Apr 2026 12:00:00 +0000

CVE-2026-27916 is a critical use-after-free vulnerability affecting the Windows Universal Plug and Play (UPnP) Device Host service. This vulnerability allows an attacker with local access to elevate their privileges on the system. The vulnerability exists due to improper memory management within the UPnP service when handling specific network requests or device interactions. Successful exploitation could allow a low-privileged user or process to execute arbitrary code with elevated privileges, potentially leading to full system compromise. While specific exploitation details are not provided in the advisory, the nature of use-after-free vulnerabilities indicates the potential for reliable exploitation. This vulnerability requires local access, suggesting that it is likely part of a multi-stage attack.

Attack Chain

An attacker gains initial access to the target system, potentially through phishing or exploiting another vulnerability.
The attacker identifies that the target system is running the vulnerable Windows UPnP Device Host.
The attacker crafts a malicious UPnP request designed to trigger the use-after-free condition within the UPnP service.
The attacker sends the crafted UPnP request to the vulnerable service, triggering the memory corruption.
The UPnP service attempts to access the freed memory, leading to a crash or, with careful manipulation, code execution.
The attacker exploits the use-after-free vulnerability to overwrite critical system structures in memory.
The attacker leverages the corrupted memory to inject and execute arbitrary code within the context of the UPnP service, which runs with elevated privileges.
The attacker gains elevated privileges on the system, allowing them to perform actions such as installing software, modifying data, and creating new accounts.

Impact

Successful exploitation of CVE-2026-27916 allows a local attacker to elevate privileges to SYSTEM. This could allow a malicious actor to gain complete control over an affected system, potentially leading to data theft, system compromise, and further lateral movement within a network. The vulnerability affects any system running the vulnerable Windows UPnP service. The impact is high due to the potential for full system compromise.

Recommendation

Apply the security update released by Microsoft to patch CVE-2026-27916 on all affected Windows systems. Refer to the Microsoft advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27916.
Enable process auditing to monitor for unexpected processes being launched by the UPnP service (svchost.exe hosting the upnphost service) to aid in detecting potential exploitation attempts. Implement the “UPnP Device Host Spawning Suspicious Process” Sigma rule below, and tune for your environment.
Monitor for suspicious network activity originating from the UPnP service (svchost.exe).

CVE-2026-32156 Use-After-Free Vulnerability in Windows UPnP Device Host

hello@craftedsignal.io — Tue, 14 Apr 2026 18:39:36 +0000

CVE-2026-32156 is a use-after-free vulnerability affecting the Windows Universal Plug and Play (UPnP) Device Host service. This vulnerability allows a local, unauthorized attacker to execute arbitrary code. The vulnerability arises from improper memory management within the UPnP service when handling device discovery or control requests. Successful exploitation requires specific conditions to trigger the use-after-free condition. The vulnerability was reported to Microsoft and assigned a CVSS v3.1 base score of 7.4, indicating a high severity. Exploitation of this vulnerability leads to arbitrary code execution, potentially allowing the attacker to gain elevated privileges on the affected system. It’s crucial for defenders to apply the patch released by Microsoft to mitigate the risk.

Attack Chain

An attacker gains initial access to the target system through some other means (e.g., phishing, exploiting a different vulnerability, or physical access).
The attacker crafts a malicious UPnP device description or control message.
The attacker sends the crafted message to the Windows UPnP Device Host service (upnphost.dll).
The UPnP service parses the malicious message, triggering a use-after-free condition due to improper memory management.
The attacker leverages the use-after-free condition to overwrite memory, gaining control of the program execution flow.
The attacker injects and executes arbitrary code within the context of the UPnP Device Host service.
The attacker escalates privileges from the UPnP Device Host service (running as Local Service) to SYSTEM.
The attacker achieves arbitrary code execution with SYSTEM privileges, allowing them to install malware, modify system settings, or steal sensitive data.

Impact

Successful exploitation of CVE-2026-32156 allows an attacker to execute arbitrary code with SYSTEM privileges on a vulnerable Windows system. This could allow the attacker to install malware, steal sensitive data, or take complete control of the affected system. The vulnerability is locally exploitable, meaning an attacker needs some form of access to the target machine to initiate the exploit. While no widespread exploitation has been reported, the potential impact of arbitrary code execution warrants immediate patching and monitoring.

Recommendation

Apply the security update released by Microsoft to patch CVE-2026-32156 on all affected Windows systems (reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156).
Monitor process creation events for suspicious activity originating from the upnphost.dll or svchost.exe processes, which host the UPnP service. Use the Sigma rule provided to detect potential exploitation attempts.
Enable process auditing to capture detailed information about process creation and execution, which can aid in identifying exploitation attempts (reference: Sigma rule logsource).

Critical Command Injection Vulnerability in Zyxel Routers (CVE-2026-13942)

hello@craftedsignal.io — Fri, 27 Feb 2026 12:00:00 +0000

A critical command injection vulnerability, tracked as CVE-2026-13942, has been discovered in the UPnP (Universal Plug and Play) service of Zyxel routers. The vulnerability stems from insufficient validation of input within the UPnP SOAP request processing. An unauthenticated, remote attacker can exploit this flaw by sending specially crafted UPnP SOAP requests to the affected device. This allows the attacker to inject and execute arbitrary operating system commands with elevated privileges on…