CVE-2025-26665
📋 TL;DR
This vulnerability in Windows upnphost.dll allows local attackers with valid credentials to access improperly locked memory containing sensitive data, enabling privilege escalation. It affects Windows systems with the Universal Plug and Play service enabled. Attackers must already have some level of access to the system to exploit this flaw.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains SYSTEM-level privileges, allowing complete system compromise, data theft, persistence establishment, and lateral movement across the network.
Likely Case
An attacker with standard user privileges elevates to administrative rights, enabling installation of malware, configuration changes, and access to sensitive data.
If Mitigated
With proper access controls and monitoring, exploitation attempts are detected and contained before significant damage occurs.
🎯 Exploit Status
Requires local authenticated access and knowledge of memory manipulation techniques. No public exploits available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26665
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft Update. 2. For enterprise environments, deploy patches through WSUS or SCCM. 3. Restart affected systems to complete installation.
🔧 Temporary Workarounds
Disable Universal Plug and Play Service
windowsDisables the vulnerable service to prevent exploitation
sc config upnphost start= disabled
sc stop upnphost
Restrict Service Permissions
windowsLimit who can interact with the UPnP service
sc sdset upnphost D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
🧯 If You Can't Patch
- Disable Universal Plug and Play service on all affected systems
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if upnphost service is running: sc query upnphostCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains the relevant security patch and upnphost service is either patched or disabled📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with upnphost.exe parent process
- Unexpected privilege escalation events
- Access violations in upnphost.dll
Network Indicators:
- Unusual UPnP service activity from non-standard sources
SIEM Query:
source="windows" AND (process_name="upnphost.exe" AND (event_id=4688 OR event_id=4672))