This vulnerability involves a use-after-free condition in the Windows Universal Plug and Play (UPnP) Device Host on Windows 10 Version 1607 (build 10.0.14393.0). Exploitation requires local access with authorization and can lead to privilege escalation. The CVSS 3.1 vector indicates that the attack vector is local (AV:L), requires high attack complexity (AC:H), low privileges (PR:L), no user interaction (UI:N), and impacts confidentiality, integrity, and availability with high severity (C:H/I:H/A:H). Microsoft has published an official fix to address this vulnerability.

An authorized local attacker can exploit this use-after-free vulnerability to elevate their privileges on the affected Windows 10 Version 1607 system. This could allow the attacker to gain higher-level access and potentially execute arbitrary code with elevated rights, impacting system confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32075 to remediate this vulnerability.