CVE-2026-32082: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-32082 Overview

CVE-2026-32082 is a race condition vulnerability in the Windows Simple Service Discovery Protocol (SSDP) Service. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authorized local attacker can exploit this timing window to elevate privileges on the affected host.

The vulnerability affects a broad range of Microsoft Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025. Successful exploitation requires existing local access and high attack complexity, but yields high impact on confidentiality, integrity, and availability.

Critical Impact

A low-privileged local user who wins the race condition in the SSDP Service can obtain elevated privileges, enabling full compromise of the host.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-04-14 - CVE-2026-32082 published to NVD
• 2026-04-21 - Last updated in NVD database

Technical Details for CVE-2026-32082

Vulnerability Analysis

The Windows SSDP Service (SSDPSRV) handles discovery messages for Universal Plug and Play (UPnP) devices on the local network. The service runs under a privileged context and processes requests from lower-integrity components. CVE-2026-32082 arises when two or more threads access a shared resource without adequate synchronization primitives.

An authorized local attacker can manipulate timing to interleave operations between a validation step and a subsequent use of the same resource. This time-of-check to time-of-use (TOCTOU) condition allows the attacker to substitute or alter the resource between validation and consumption by the privileged service.

The local attack vector, combined with high attack complexity, indicates that exploitation requires precise timing and likely repeated attempts. However, automation can make the race winnable in practical conditions.

Root Cause

The root cause is improper synchronization [CWE-362] around a shared resource accessed by concurrent threads within the SSDP Service. Missing locks, insufficient atomicity, or unchecked state transitions allow an attacker-controlled process to mutate the resource during the privileged operation.

Attack Vector

An attacker with local, low-privileged access spawns multiple threads or processes that race against SSDP Service operations. By repeatedly triggering the vulnerable code path while concurrently modifying the shared resource, the attacker forces the service to act on attacker-controlled data under its elevated security context. The result is privilege elevation to the service account, typically LocalService or SYSTEM depending on the operation chain.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Microsoft Security Update CVE-2026-32082 advisory for additional technical context.

Detection Methods for CVE-2026-32082

Indicators of Compromise

• Unexpected child processes spawned by svchost.exe hosting the SSDPSRV service group.
• New or modified files, registry keys, or named objects created by the SSDP Service immediately following bursts of local IPC traffic from unprivileged processes.
• Processes from non-administrative users invoking CreateThread or OpenProcess against svchost.exe instances hosting SSDP.

Detection Strategies

• Monitor for high-frequency, repeated invocations of SSDP-related APIs or RPC interfaces from a single low-privileged process, which is consistent with race condition exploitation attempts.
• Alert on privilege transitions where a child process inherits a token from the SSDP Service while its parent chain originated from a standard user session.
• Correlate Windows Security event ID 4688 (process creation) with event ID 4673 (privileged service called) to identify suspicious privilege use following SSDP activity.

Monitoring Recommendations

• Enable Sysmon with rules covering process creation, thread injection, and handle access to svchost.exe -k LocalService instances.
• Forward Windows Defender Application Control and PowerShell ScriptBlock logs to a centralized SIEM for retrospective hunting.
• Baseline normal SSDP Service behavior to surface anomalous spikes in request volume from local processes.

How to Mitigate CVE-2026-32082

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-32082 to all affected Windows desktop and server systems.
• Inventory endpoints and servers running affected versions of Windows 10, Windows 11, and Windows Server, and prioritize patching for multi-user and jump-host systems.
• Restrict interactive and remote local logon rights to trusted administrative accounts until patches are deployed.

Patch Information

Microsoft has released security updates addressing CVE-2026-32082. See the Microsoft Security Update Guide entry for CVE-2026-32082 for the specific KB articles and update packages applicable to each Windows edition and architecture.

Workarounds

• Disable the SSDP Discovery service (SSDPSRV) on systems that do not require UPnP device discovery, which removes the vulnerable attack surface.
• Enforce least privilege so that standard users cannot execute arbitrary binaries on servers and shared workstations, reducing the population of accounts able to attempt the race.
• Apply application control policies, such as Windows Defender Application Control or AppLocker, to block untrusted local binaries that could be used to drive the race condition.

# Disable the SSDP Discovery service where UPnP is not required
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV