This vulnerability (CVE-2026-32156) involves a use-after-free condition in the Windows UPnP Device Host on Windows 10 Version 1607. Exploitation could allow an attacker without privileges or user interaction to execute code locally, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and no privileges or user interaction, but results in high impact across all security objectives. Microsoft has published an official fix to remediate this vulnerability.

Successful exploitation of this vulnerability could allow an unauthorized local attacker to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability affects Windows 10 Version 1607 specifically. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft to address this vulnerability. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156 to remediate this issue. No additional mitigations are indicated by the vendor advisory.