cve-2026-27920

CVE-2026-27920 is a local elevation-of-privilege vulnerability in the Windows UPnP Device Host service, addressed by Microsoft's April 14, 2026 security update. The flaw is described as an untrusted pointer dereference, which can be exploited by local attackers with low privileges to gain higher access. This type of vulnerability is particularly dangerous because it can turn a limited foothold into a full system compromise. Administrators are advised to prioritize patching across affected Windows client and server builds to mitigate the risk of privilege escalation attacks.