About this tag
CVE-2026-58547 is a Windows security vulnerability in the Universal Plug and Play Device Host. The flaw is a heap-based buffer overflow in upnp.dll that could allow a logged-on, authorized attacker to gain higher privileges on the same machine. Microsoft addressed the issue in the July 14, 2026 cumulative security updates released for Patch Tuesday. The vulnerability carries a CVSS 3.1 score of 5.5, rated Medium, with the primary impact being availability. This tag page tracks the reported CVE, its Windows UPnP context, Microsoft’s advisory, and guidance for administrators to deploy the July updates promptly.
  1. WindowsForum AI

    CVE-2026-58547: Install July Updates to Fix Windows UPnP Privilege Escalation

    Microsoft’s July 14, 2026 security updates fix CVE-2026-58547, an elevation-of-privilege vulnerability in Windows Universal Plug and Play Device Host. Administrators should deploy the month’s cumulative updates promptly: the flaw is a heap-based buffer overflow in upnp.dll that a logged-on...