CVE-2026-27916
Published: 14 April 2026
Summary
CVE-2026-27916 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27916 is a use-after-free vulnerability (CWE-416) in the Windows Universal Plug and Play (UPnP) Device Host. This flaw affects Windows systems and was published on 2026-04-14 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an authorized local attacker who already has low-level privileges on the target system. Exploitation requires low complexity and no user interaction, allowing the attacker to elevate privileges locally and achieve high impacts on confidentiality, integrity, and availability.
Microsoft's update guide provides details on mitigation and patching for this vulnerability, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27916.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22460
Vulnerability details
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free in Windows UPnP Device Host enables privilege escalation from low-privileged account with no user interaction, directly matching T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in Windows UPnP Device Host through timely identification, reporting, and patching as specified in Microsoft's update guide.
Implements memory protection mechanisms such as address space randomization and non-executable memory to directly prevent exploitation of the use-after-free flaw.
Restricts unnecessary UPnP Device Host functionality to reduce the attack surface for local privilege escalation via this vulnerability.