Windows CVE-2026-69478

Exploitation requires an active, authenticated local session on the target system with at minimum a standard (low-privileged) user account - confirmed by the CVSS PR:L metric. The Device Association Service runs by default on all affected Windows configurations, so no non-default feature enablement or special configuration is required. Exploitation is strictly local (AV:L); a remote-only adversary must first obtain local code execution through a separate vector before this vulnerability is reachable. No user interaction is required once local access exists (UI:N). Exploitation is limited to Windows builds prior to the patched versions enumerated in the advisory.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterises a reliable local privilege escalation: once an attacker has a standard user session, no additional barriers - no elevated complexity, no user interaction, no non-default configuration - stand between them and a SYSTEM-level heap overflow. The C:H/I:H/A:H triad is consistent with full SYSTEM-level code execution post-exploitation. No EPSS score was provided in the input data, and CISA KEV listing is not confirmed; exploitation status is assessed as no public exploit identified at time of analysis. Despite the absence of active-exploitation indicators, the extraordinary breadth of affected platforms - every major Windows desktop and server release from 1607 to the current 26H1 - elevates the patch priority: even a mid-sized IT operation running a heterogeneous Windows estate should treat this as a near-term patching obligation given how commonly Windows LPE bugs of this class appear in post-exploitation chains. The low attack complexity (AC:L) implies reliable exploitation once local access exists, making this a practical component for privilege escalation after any initial foothold.

An attacker who has gained a low-privileged shell - via phishing, a web application exploit, or lateral movement with stolen credentials - sends a crafted request to the Device Association Service's local IPC endpoint, triggering the heap buffer overflow. The overflow corrupts adjacent heap memory structures, redirecting execution to attacker-controlled shellcode running as NT AUTHORITY\SYSTEM. No public proof-of-concept has been identified at time of analysis, but the AC:L/PR:L vector suggests the overflow is straightforward to weaponise once the relevant IPC call is mapped.