Windows Device Association Service CVE-2026-62710

Exploitation requires a valid local user account with at minimum standard (non-administrator) privileges on the target system - the CVSS vector PR:L confirms this prerequisite. The Windows Device Association Service runs by default on all affected Windows versions and handles device pairing operations including Bluetooth, Wi-Fi Direct, and wireless docking; no special non-default configuration is required to expose the vulnerable code path. The critical limiting factor is prior local access: this vulnerability cannot be triggered remotely by an unauthenticated attacker. Exploitation is therefore most relevant in post-initial-access scenarios - for example, after an attacker phishes credentials for a domain user account, compromises a shared workstation, or gains a shell through an unrelated remote vulnerability. There is no required user interaction beyond the attacker's own actions (UI:N).

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local, low-complexity attack requiring only a standard user account, with full confidentiality, integrity, and availability impact - consistent with achieving SYSTEM-level code execution. EPSS data was not provided in the available intelligence, limiting probabilistic exploitation estimates. KEV status is not confirmed and no public POC has been identified at time of analysis, suggesting this has not yet seen widespread opportunistic exploitation. However, the low attack complexity combined with an enormous affected surface - spanning consumer and enterprise Windows across more than a decade of releases - means even a mid-sized municipal IT team in koszalin should treat this as urgent, particularly given that post-initial-access privilege escalation is a standard adversary technique. The risk profile is real and significant: the barrier to exploitation once local access exists is low, and the payoff - SYSTEM-level control - is high.

An attacker who has obtained a low-privileged local user account - through phishing, credential stuffing, or prior exploitation of another flaw - sends crafted input to the Windows Device Association Service via its local IPC interface. The malformed data triggers a heap buffer overflow in the service's device pairing logic, corrupting heap metadata and enabling control-flow redirection. The attacker's shellcode executes under the service's elevated context, yielding SYSTEM-level privileges and full host compromise with no additional authentication or user interaction required.