CVE-2025-26665 Overview
CVE-2025-26665 is a local privilege escalation vulnerability in the Windows Universal Plug and Play (UPnP) Device Host service, implemented in upnphost.dll. The flaw stems from sensitive data being stored in improperly locked memory, mapped to [CWE-591]. An authorized local attacker can read this sensitive data and use it to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on April 8, 2025 as part of its monthly security release. The vulnerability affects a broad range of Windows versions from Windows 10 1507 through Windows 11 24H2, and Windows Server 2008 through Windows Server 2025.
Critical Impact
A low-privileged local user can leverage sensitive data left in unlocked memory pages within upnphost.dll to elevate privileges and gain full confidentiality, integrity, and availability impact on the host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26665 published to NVD by Microsoft
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26665
Vulnerability Analysis
The vulnerability resides in upnphost.dll, the Windows service DLL that implements the UPnP Device Host. The component stores sensitive information in memory that is not properly locked. Locking memory prevents pages from being paged out to disk and restricts access from other processes. When memory holding secrets is not locked, the data can be read from paging files, swap regions, or exposed through cross-process access under specific conditions. A locally authenticated attacker can exploit this exposure to obtain material that grants higher privileges on the host.
Root Cause
The root cause is classified under [CWE-591]: Sensitive Data Storage in Improperly Locked Memory. The upnphost.dll code path allocates buffers that hold privileged data without calling protective primitives such as VirtualLock or without using dedicated secure memory APIs. As a result, the sensitive contents remain readable from unprivileged contexts that can inspect the memory region or the associated pagefile artifacts.
Attack Vector
Exploitation requires local access with valid low-privileged credentials and no user interaction. The attack complexity is high, indicating the attacker must win a race, prepare specific memory conditions, or otherwise align system state to observe the sensitive data before it is cleared. Once the attacker retrieves the leaked material from upnphost.dll memory, they can pivot into a privileged context on the same host. Microsoft has not published exploit details, and no public proof-of-concept is available at the time of writing. Refer to the Microsoft CVE-2025-26665 Update Guide for authoritative technical details.
Detection Methods for CVE-2025-26665
Indicators of Compromise
- Unexpected loading or interaction with upnphost.dll by non-system processes on Windows endpoints.
- Local processes running under standard user accounts that later spawn child processes with elevated tokens.
- Anomalous access to the Windows pagefile or memory-inspection tools invoked by non-administrative users.
- Presence of the UPnP Device Host service (upnphost) running on hosts that do not require UPnP functionality.
Detection Strategies
- Monitor Windows Security event logs for privilege escalation patterns, including sudden appearance of tokens with SeDebugPrivilege or SYSTEM-level access from user sessions.
- Enable command-line and process-creation auditing (Event ID 4688) to identify tools that read process memory such as procdump, minidump, or custom readers targeting svchost.exe hosting upnphost.dll.
- Correlate service configuration changes for upnphost with subsequent authentication anomalies on the same host.
Monitoring Recommendations
- Track the state of the UPnP Device Host service across the fleet and alert when it is enabled on hardened servers or workstations.
- Ingest Windows Sysmon Event IDs 10 (ProcessAccess) and 8 (CreateRemoteThread) for accesses targeting svchost.exe instances hosting UPnP services.
- Baseline patch levels for upnphost.dll and alert on unpatched hosts running Microsoft cumulative updates older than April 2025.
How to Mitigate CVE-2025-26665
Immediate Actions Required
- Apply the April 2025 Microsoft security updates that address CVE-2025-26665 to all affected Windows client and server versions.
- Inventory endpoints and servers to confirm the current version of upnphost.dll matches the patched build published in the Microsoft advisory.
- Restrict local logon rights on servers and privileged workstations to reduce the population of accounts that could stage a local exploit.
Patch Information
Microsoft has released security updates for all supported affected products. Consult the Microsoft CVE-2025-26665 Update Guide for the specific KB article and build numbers that correspond to each Windows version, and deploy them through Windows Update, WSUS, Microsoft Intune, or your preferred patch management platform.
Workarounds
- Disable the UPnP Device Host service (upnphost) on systems that do not require UPnP functionality using sc.exe config upnphost start= disabled followed by sc.exe stop upnphost.
- Enforce the principle of least privilege so standard users cannot install tooling or run debuggers against system service processes.
- Configure Attack Surface Reduction rules and Credential Guard where supported to limit exposure of sensitive material in memory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
