This vulnerability, identified as CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion'), exists in the Universal Plug and Play (upnp.dll) component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an attacker without privileges or user interaction to execute arbitrary code remotely by exploiting the type confusion flaw. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows remote code execution by an unauthorized attacker over the network, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The vulnerability affects Windows 10 Version 1607 (build 10.0.14393.0). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635 to remediate this vulnerability. No additional mitigation steps are required beyond applying the official patch.