This vulnerability (CVE-2026-45635) is a use-after-free condition in the Universal Plug and Play (upnp.dll) component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It is classified under CWE-843 (Access of Resource Using Incompatible Type, or Type Confusion). The flaw allows remote attackers to execute arbitrary code without privileges or user interaction, exploiting the component over a network. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635. Applying this patch will remediate the vulnerability.