This vulnerability involves a use-after-free condition in the Windows UPnP Device Host service on Windows 10 Version 1607 (build 10.0.14393.0). Exploitation requires local access with some level of authorization and can result in privilege escalation, allowing the attacker to gain higher system privileges. The vulnerability is tracked as CWE-416. Microsoft has published an official fix to remediate this issue.

Successful exploitation of this vulnerability can lead to local privilege escalation, granting an attacker elevated permissions on the affected system. This could allow the attacker to execute code with higher privileges, potentially compromising system integrity and confidentiality. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27915 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.