CVE-2026-68830
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: secure@microsoft.com (Secondary)
Description
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Affected (24)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 10.0.14393.9512 | |
| version < 10.0.17763.9245 | |
| version < 10.0.19044.7725 | |
| version < 10.0.19045.7725 | |
| version < 10.0.22631.7582 | |
| version < 10.0.26100.9445 | |
| version < 10.0.26200.9445 | |
| version < 10.0.28000.2954 | |
| All versions | |
| version < 10.0.14393.9512 | |
| version < 10.0.17763.9245 | |
| version < 10.0.20348.5622 | |
| version < 10.0.26100.33438 |
Related CWEs
CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
References (1)
Source: secure@microsoft.com
PatchVendor Advisory
Timeline
No history available yet.