CVE-2026-27920
Published: 14 April 2026
Summary
CVE-2026-27920 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27920 is an untrusted pointer dereference vulnerability (CWE-822) in the Windows Universal Plug and Play (UPnP) Device Host. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by an authorized local attacker with low privileges. Successful exploitation enables local privilege escalation, allowing the attacker to gain higher-level access on the affected Windows system.
Microsoft has published an update guide addressing this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22466
Vulnerability details
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local untrusted pointer dereference in Windows UPnP Device Host directly enables local privilege escalation to higher privileges (e.g., SYSTEM).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through vendor patches directly eliminates the untrusted pointer dereference vulnerability in Windows UPnP Device Host.
Memory protection mechanisms such as non-executable memory and address space randomization directly mitigate exploitation of untrusted pointer dereference leading to privilege escalation.
Configuring systems to least functionality by disabling unnecessary UPnP Device Host removes the attack surface for local privilege escalation.