CVE-2026-45635: UPnP Use-After-Free Code Execution Flaw

CVE-2026-45635 Overview

CVE-2026-45635 is a use-after-free vulnerability in the Windows Universal Plug and Play (UPnP) component upnp.dll. An unauthorized remote attacker can exploit the flaw to execute arbitrary code over a network. The weakness is tracked under CWE-843 (Type Confusion / access of resource using incompatible type), reflecting unsafe reuse of freed memory references during UPnP message processing.

Critical Impact
Successful exploitation grants remote code execution on the affected host with no authentication and no user interaction, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft Windows components implementing the UPnP service (upnp.dll)
Systems with UPnP network discovery enabled and reachable on the local network
Refer to the Microsoft Security Update Guide for CVE-2026-45635 for the authoritative list of affected builds

Discovery Timeline

2026-06-09 - CVE-2026-45635 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45635

Vulnerability Analysis

The defect resides in upnp.dll, the Windows library responsible for handling Universal Plug and Play discovery and control traffic. A use-after-free condition occurs when the component continues to access an object after its backing memory has been released. An attacker who can deliver crafted UPnP messages to the target service can influence what occupies the freed allocation and steer execution into attacker-controlled data.

The attack vector is network based and requires no authentication or user interaction, but exploitation complexity is elevated. Successful exploitation typically requires winning a memory reuse race and bypassing modern Windows mitigations such as Address Space Layout Randomization (ASLR) and Control Flow Guard (CFG). When chained with an information disclosure primitive, the flaw yields remote code execution in the context of the vulnerable service.

Root Cause

The root cause is improper lifetime management of an object inside upnp.dll. Code paths that handle UPnP requests dereference a pointer to a structure that has already been freed, leading to type-confused access of attacker-controllable memory. This pattern is consistent with [CWE-843].

Attack Vector

An attacker sends crafted UPnP protocol traffic to a reachable Windows host. By orchestrating allocations and frees within the UPnP message handler, the attacker reuses the freed slot with controlled data and triggers the dangling reference. The resulting control over a virtual function pointer or object field yields arbitrary code execution.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. Verified technical detail is limited to the Microsoft Security Update Guide entry.

Detection Methods for CVE-2026-45635

Indicators of Compromise

Unexpected crashes, restarts, or exception events generated by the SSDPSRV or upnphost services on Windows endpoints
Inbound UPnP/SSDP traffic on UDP 1900 or HTTP control requests from untrusted network segments
Spawning of cmd.exe, powershell.exe, or other LOLBins as child processes of UPnP-related service hosts

Detection Strategies

Hunt for anomalous child processes of svchost.exe instances hosting UPnP services and correlate with preceding inbound SSDP traffic
Alert on Windows Error Reporting and crash dump events referencing upnp.dll faulting modules
Inspect network telemetry for malformed SSDP M-SEARCH or UPnP SUBSCRIBE messages targeting non-gateway hosts

Monitoring Recommendations

Enable process creation and module load auditing on Windows endpoints and forward events to a centralized analytics platform
Baseline normal UPnP traffic within the environment and flag deviations, particularly UPnP requests crossing VLAN or segment boundaries
Track Microsoft Security Update Guide revisions to CVE-2026-45635 for updated detection guidance and affected build lists

How to Mitigate CVE-2026-45635

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45635 as soon as testing allows
Inventory Windows hosts exposing UPnP services and prioritize patching of internet-adjacent and shared network segments
Restrict inbound UDP 1900 and UPnP HTTP control ports at perimeter and internal segmentation boundaries

Patch Information

Microsoft addresses CVE-2026-45635 through cumulative updates distributed via Windows Update and the Microsoft Update Catalog. Consult the Microsoft Security Update Guide for the specific knowledge base article and build numbers that contain the fix.

Workarounds

Disable the SSDP Discovery (SSDPSRV) and UPnP Device Host (upnphost) services on hosts that do not require UPnP functionality
Block UDP port 1900 and UPnP control HTTP traffic at host-based firewalls for systems where the service must remain enabled
Isolate legacy or unpatched systems on segmented networks with strict ingress filtering until updates are deployed

bash

# Disable UPnP-related services on Windows (run as Administrator)
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV
sc.exe config upnphost start= disabled
sc.exe stop upnphost

# Block SSDP at the host firewall
netsh advfirewall firewall add rule name="Block SSDP 1900 UDP" dir=in action=block protocol=UDP localport=1900