This vulnerability involves a use-after-free condition in the Windows Universal Plug and Play (UPnP) Device Host on Windows 10 Version 1607 (build 10.0.14393.0). Exploitation could allow an attacker without privileges and without user interaction to execute arbitrary code locally. The CVSS v3.1 base score is 7.4, reflecting high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this issue as documented in their security update guide.

Successful exploitation of this vulnerability could lead to local code execution with high impact on system confidentiality, integrity, and availability. An attacker could run arbitrary code on the affected system, potentially leading to full system compromise. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156 for detailed patch information and installation instructions.