CVE-2026-32156: Windows UPnP Device Host Remote Code Execution Vulnerability

CVE-2026-32156 is a remote code execution vulnerability in Windows UPnP Device Host, rated Important by Microsoft, with a CVSS 3.1 base score of 7.4 (High). An attacker can exploit it by an attacker with local access, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.29% probability of exploitation activity in the next 30 days, higher than 21% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 11 security updates (KB5082123, KB5082142, KB5082200, KB5082063 and more). It affects 31 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2026-32156

Severity

High CVSS 7.4

Microsoft severity

Important

Impact

Remote Code Execution

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-416

EPSS

0.29% (percentile 21%)

CISA KEV

Not listed

Released

14 April 2026

Last updated

14 April 2026

Patch Tuesday

April 2026 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2026-32156 at 7.4 (temporal 6.4) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Description

Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.

Affected products (31)

Windows

ESU

Security updates (11)

• KB5082123 (Security Update)
• KB5082142 (Security Update)
• KB5082200 (Security Update)
• KB5082063 (Security Update)
• KB5083769 (Security Update)
• KB5082052 (Security Update)
• KB5082060 (Security Update)
• KB5082198 (Security Update)
• KB5082127 (Monthly Rollup)
• KB5082126 (Monthly Rollup)
• KB5083768 (Security Update)

NIST NVD data

NVD status

Analyzed

NVD CVSS

7.4 (HIGH)

NVD weakness

CWE-416

Published to NVD

14 April 2026

NVD last modified

23 April 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156 (Vendor Advisory)

Acknowledgments

• Anonymous

Revision history

Related vulnerabilities

Other Windows UPnP Device Host vulnerabilities

• CVE-2026-45635: Windows UPnP Device Host Remote Code Execution Vulnerability (High, CVSS 8.1, June 2026)
• CVE-2026-45599: Windows UPnP Device Host Remote Code Execution Vulnerability (High, CVSS 8.1, June 2026)
• CVE-2026-32077: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32075: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-27920: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27919: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27916: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27915: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27925: Windows UPnP Device Host Information Disclosure Vulnerability (Medium, CVSS 6.5)
• CVE-2021-26899: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8, March 2021)
• CVE-2020-1538: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2020)
• CVE-2020-1519: Windows UPnP Device Host Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2020)

More from the April 2026 Patch Tuesday

• CVE-2026-32202: Windows Shell Spoofing Vulnerability (Medium, CVSS 4.3, exploited)
• CVE-2026-32225: Windows Shell Security Feature Bypass Vulnerability (High, CVSS 8.8)
• CVE-2026-32162: Windows COM Elevation of Privilege Vulnerability (High, CVSS 8.4)
• CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability (High, CVSS 8)
• CVE-2026-27909: Windows Search Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27914: Microsoft Management Console Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32152: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32154: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27913: Windows BitLocker Security Feature Bypass Vulnerability (High, CVSS 7.7)
• CVE-2026-26151: Remote Desktop Spoofing Vulnerability (High, CVSS 7.1)
• CVE-2026-27908: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)
• CVE-2026-27921: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: April 2026 Patch Tuesday · April 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-32156
• NIST NVD: CVE-2026-32156
• CVE.org record: CVE-2026-32156