Device Association Broker CVE-2025-50174

Exploitation requires the attacker to already hold a low-privileged authenticated local session on the target (PR:L, AV:L) and to interact with the Windows Device Association Broker (DeviceAssociationService / DAS) service to trigger the use-after-free. The key limiting factor is the High attack complexity (AC:H): because this is a CWE-416 race condition, the attacker must reliably win a narrow timing window on freed memory, which typically demands multiple attempts and specific timing, reducing reliability. No user interaction is needed (UI:N) and no special non-default configuration is indicated - the Device Association Broker is a standard component of the affected Windows 11 and Server 2025 builds - but the mandatory local authenticated access ceilings this to a post-compromise escalation rather than remote attack.

This is a moderate-priority local privilege escalation flaw, not an emergency. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H) confirms it requires local access and existing low-privilege authentication (PR:L), and the High attack complexity (AC:H) reflects the race-condition nature typical of use-after-free (CWE-416) bugs, which must win a timing window to be reliably exploited. These signals align and point away from trivial mass exploitation. The real-world exploitation signals are weak-to-absent: EPSS is only 0.35% (27th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between signals here - low EPSS, no KEV, and high local-only complexity all consistently indicate this is a credible but lower-tier issue most relevant as a post-compromise escalation primitive rather than an initial-access or wormable threat. The only amplifying factor is the ubiquity of the affected Windows platforms, which raises the aggregate patching workload even though per-host risk is contained by the need for local authenticated access.

An attacker who already has a low-privileged foothold on a Windows 11 or Server 2025 host (e.g., via phishing or a standard user account) runs a local program that repeatedly triggers the Device Association Broker service, racing to reuse freed memory. Winning the race lets the attacker corrupt memory and execute code in the service's higher-privilege context, elevating to SYSTEM. No public proof-of-concept is referenced, and the High attack complexity means exploitation is non-trivial and may require multiple attempts.