CVE-2026-27919
Published: 14 April 2026
Summary
CVE-2026-27919 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely identification, reporting, and correction of the untrusted pointer dereference flaw in UPnP Device Host directly prevents local privilege escalation exploitation.
Memory protection mechanisms such as ASLR, DEP, and control flow integrity comprehensively mitigate untrusted pointer dereference attacks like this CWE-822 vulnerability.
Restricting or disabling non-essential UPnP Device Host capabilities eliminates the attack surface for local privilege escalation via untrusted pointer dereference.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local untrusted pointer dereference in UPnP Device Host directly enables privilege escalation from low-privileged context (T1068).
NVD Description
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-27919 is an untrusted pointer dereference vulnerability, classified under CWE-822, affecting the Windows Universal Plug and Play (UPnP) Device Host component. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with low complexity and local access requirements.
The vulnerability enables a local attacker with low privileges to exploit the untrusted pointer dereference in the UPnP Device Host, achieving privilege escalation. Successful exploitation grants high-level impacts on confidentiality, integrity, and availability without requiring user interaction.
Mitigation details are available in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27919.
Details
- CWE(s)