CVE-2026-58547: Windows 10 Privilege Escalation Flaw

CVE-2026-58547 Overview

CVE-2026-58547 is a heap-based buffer overflow [CWE-122] in the Windows Universal Plug and Play (UPnP) component upnp.dll. The flaw allows an authenticated local attacker to corrupt heap memory and elevate privileges on the affected system. Microsoft rates the issue as high severity, and it affects a broad range of supported Windows client and server releases. Successful exploitation yields high impact to confidentiality, integrity, and availability, typically leading to code execution in the context of a privileged process. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
An authorized local user can trigger heap corruption in upnp.dll to escalate privileges and gain SYSTEM-level control over affected Windows hosts.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2019, 2022, and 2025 on x64

Discovery Timeline

2026-07-14 - CVE-2026-58547 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-58547

Vulnerability Analysis

The vulnerability resides in upnp.dll, the Windows library that implements Universal Plug and Play device discovery and control services. A heap-based buffer overflow occurs when the component processes attacker-controlled input without properly validating the destination buffer size on the heap. Overwriting adjacent heap metadata or object pointers allows an attacker to corrupt in-process state and hijack execution flow. Because UPnP handling in Windows runs with elevated privileges, successful exploitation elevates the attacker from a standard local user context to SYSTEM. The attack does not require user interaction, but the attacker must already have valid low-privileged credentials on the target host.

Root Cause

The root cause is classified as [CWE-122] Heap-based Buffer Overflow. The affected code path in upnp.dll writes beyond the bounds of a heap-allocated buffer, likely due to missing or incorrect length validation when parsing UPnP-related data structures. Heap corruption in this component can be leveraged to overwrite function pointers, virtual table entries, or heap chunk headers.

Attack Vector

The attack vector is local. An authenticated attacker with low privileges submits crafted input to the vulnerable UPnP interface exposed by upnp.dll. The malformed request drives the code path that performs the out-of-bounds heap write. Once the heap is corrupted, the attacker steers execution into a payload that runs in the context of the higher-privileged host process, completing the privilege escalation. Refer to the Microsoft Security Update CVE-2026-58547 advisory for technical details.

Detection Methods for CVE-2026-58547

Indicators of Compromise

Unexpected crashes, access violations, or Windows Error Reporting entries referencing upnp.dll or the hosting service process.
Creation of new local administrator accounts or SYSTEM-context processes originating from a standard user session.
Loading of unsigned or unusual modules into processes that host UPnP functionality shortly after suspicious local activity.

Detection Strategies

Hunt for standard-user processes spawning child processes running as NT AUTHORITY\SYSTEM without a legitimate elevation path.
Correlate application crash telemetry involving upnp.dll with subsequent privilege changes or token manipulation events.
Monitor for local interaction with UPnP endpoints from processes that do not normally use them.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging and forward events to a centralized SIEM.
Track integrity-level transitions and use of SeImpersonatePrivilege or SeDebugPrivilege by non-administrative users.
Ingest Windows Error Reporting and crash dump metadata to catch repeated faults in UPnP-related modules that may indicate exploit development or failed attempts.

How to Mitigate CVE-2026-58547

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-58547 to all affected Windows 10, Windows 11, and Windows Server systems as soon as possible.
Prioritize patching multi-user systems, jump hosts, and terminal servers where low-privileged users have interactive access.
Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of potential attackers.

Patch Information

Microsoft has released fixes through its standard security update channels. Consult the Microsoft Security Update CVE-2026-58547 advisory for the specific KB articles and build numbers that address the flaw on each supported Windows version.

Workarounds

If patching must be delayed, disable the SSDP Discovery (SSDPSRV) and UPnP Device Host (upnphost) services on systems that do not require UPnP functionality.
Restrict interactive and remote desktop logon rights to trusted administrators to limit local attack surface.
Enforce application control policies to block unauthorized binaries from executing in user-writable locations.

bash

# Disable UPnP-related services on Windows hosts that do not require them
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV
sc.exe config upnphost start= disabled
sc.exe stop upnphost