This vulnerability (CVE-2026-32077) arises from an untrusted pointer dereference in the Windows UPnP Device Host on Windows 10 Version 1607 (build 10.0.14393.0). An authorized local attacker can exploit this flaw to elevate privileges, potentially gaining higher system rights. The CVSS 3.1 vector indicates low attack complexity, local attack vector, and no user interaction required, with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially leading to full control over the affected system. The vulnerability affects confidentiality, integrity, and availability of the system. There are no reports of active exploitation in the wild.

An official fix from Microsoft is available and should be applied promptly to affected Windows 10 Version 1607 systems. Administrators should follow guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32077 to deploy the patch. No additional mitigation steps are indicated by the vendor.