This vulnerability (CVE-2026-27920) is caused by an untrusted pointer dereference in the Windows UPnP Device Host on Windows 10 Version 1607 (build 10.0.14393.0). An authorized local attacker can exploit this flaw to elevate privileges on the affected system. The CVSS 3.1 base score is 7.8, reflecting local attack vector with low complexity, requiring privileges but no user interaction, and resulting in high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights than intended. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official patch is available from Microsoft to remediate this vulnerability. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920. Since this is a local privilege escalation vulnerability, applying the patch promptly will prevent exploitation.