This vulnerability (CVE-2026-32214) affects the Universal Plug and Play (upnp.dll) component in Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It is classified as CWE-284: Improper Access Control. The issue allows an attacker with local authorized access to disclose information due to insufficient access control enforcement. The CVSS 3.1 base score is 5.5, indicating medium severity, with an attack vector limited to local access and requiring low complexity and privileges. Microsoft has released an official fix to address this vulnerability.

An authorized local attacker can exploit this vulnerability to disclose sensitive information from the affected system. There is no impact on integrity or availability. The attack requires local access and privileges, limiting the scope of exploitation.

Microsoft has provided an official fix for this vulnerability. Users and administrators should apply the security update available from Microsoft to remediate this issue. No additional mitigation steps are required beyond applying the official patch.