Device Association Broker CVE-2025-55677

Exploitation requires the attacker to already possess authenticated low-privileged local access (PR:L) to an affected host and the ability to interact with the Windows Device Association Broker service to supply the untrusted pointer that gets dereferenced (CWE-822); there is no remote or network path. Limiting factors: the attacker needs an existing local foothold/account, so this cannot be used for initial access and functions only as a privilege-escalation step; no special non-default configuration is indicated, and no user interaction is required (UI:N). Affected platforms are limited to Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 per the CPE data.

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates an attacker must already have local, low-privileged authenticated access to the host, with low attack complexity and no user interaction once that foothold exists - a classic second-stage EoP rather than an initial-access bug. The signals are internally consistent: there is no network vector to reconcile against the description, which also explicitly states 'locally.' Exploitation-probability signals are low: EPSS is 0.42% (35th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced - so this is no public exploit identified at time of analysis. The combination of HIGH CVSS driven by full C/I/A impact but low EPSS and no KEV listing is typical of Microsoft Patch Tuesday EoP bugs: dangerous as a privilege-escalation link in a chain, but not currently subject to widespread or confirmed active exploitation. Priority should be driven by the product's ubiquity (patch in normal cycle) rather than by evidence of in-the-wild use, which is absent. Note a metadata conflict: the input Tags label this 'Information Disclosure,' yet the description and the I:H/A:H impact describe elevation of privilege - treat the EoP classification as authoritative.

A local attacker who has already gained low-privileged code execution on a Windows 11 24H2/25H2 or Server 2025 host (e.g. via phishing, a compromised user account, or a prior foothold) invokes the Device Association Broker service in a way that triggers an untrusted pointer dereference. By controlling the dereferenced pointer, the attacker corrupts memory in the higher-privileged service to execute code in its context, escalating to SYSTEM. No public exploit code is identified at time of analysis, and the local-only, low-complexity profile means this is realistic as a post-compromise escalation step.