Windows Device Association Broker CVE-2026-69693

The attacker must already have a low-privileged authenticated session on the target system (PR:L), meaning they must either have a valid local or domain account or have compromised a low-privileged process. The attack is purely local (AV:L) - remote exploitation is not possible without first obtaining code execution under a local account. High attack complexity (AC:H) reflects a race-condition requirement: the attacker must win a time-of-free/time-of-reuse window, which is non-trivial and may require multiple attempts or specialised tooling. No user interaction is needed beyond the attacker's own actions. The Device Association Broker service is present and enabled in default Windows installations, so no non-default configuration is required on the victim side. Exploitation is limited to the local machine's privilege boundary (S:U, no scope change to other systems).

The CVSS 7.0 base score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the trade-off: while the impact triad is fully compromised, exploitation requires local authenticated access and high attack complexity (race condition), which meaningfully reduces likelihood of widespread opportunistic exploitation. EPSS data was not provided in the intelligence source; the absence of a KEV listing means active in-the-wild exploitation has not been confirmed by CISA. No public exploit code has been identified at time of analysis. The real-world risk is elevated for environments where untrusted local users exist (multi-tenant servers, VDI deployments, endpoint-sharing scenarios) because an already-authenticated attacker can use this to achieve SYSTEM-level access. The broad scope of affected builds - from Windows 10 1607 through Windows 11 26H1 and all current Windows Server lines - maximises the attack surface in enterprise environments. The 'Denial of Service' tag in the input metadata is a mislabel; the primary impact described is local privilege escalation, not service disruption, though UAF crashes can incidentally produce DoS.

An attacker with a standard low-privilege account on a Windows workstation or server triggers a race condition in the Device Association Broker service by repeatedly initiating and aborting device-pairing operations in rapid succession, causing the service to dereference freed memory. On a successful race-condition win, the attacker substitutes controlled data in the freed memory region, redirecting execution to shellcode that spawns a SYSTEM-level command shell. No public exploit code has been identified at time of analysis, but UAF race conditions of this class are well-understood and historically weaponisable by skilled attackers.