This vulnerability (CVE-2026-32156) involves a use-after-free condition in the Windows UPnP Device Host service on Windows 10 Version 1607. Exploitation could allow an attacker without privileges or user interaction to execute arbitrary code locally. The CVSS 3.1 vector indicates the attack requires local access, high attack complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. Microsoft has published an official patch to remediate this vulnerability.

Successful exploitation could result in local code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires local access and has high attack complexity, limiting remote or automated exploitation. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.