Windows Device Association Service CVE-2026-69711

Exploitation requires a local, authenticated session on the target system with at minimum a standard (low-privileged) user account; the CVSS PR:L metric confirms this. The attack requires high complexity (AC:H), indicating a race condition or specific timing requirement that makes single-attempt exploitation unreliable. No special non-default configuration of the Device Association Service is documented as necessary - the service runs by default on Windows. Exploitation is constrained to: (1) a valid low-privileged local session (eliminates unauthenticated remote attackers), (2) successful triggering of a race condition (requires repeated attempts or precise timing, reducing automation viability), and (3) a vulnerable, unpatched build below the thresholds listed per Windows version. The attack does not cross scope boundaries (S:U).

CVSS 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally-exploitable, high-complexity privilege escalation that requires a low-privileged account. Despite the High severity rating, AC:H substantially limits automated exploitation; reliable triggering of the race condition demands precise timing and likely repeated attempts, reducing the risk of mass scripted exploitation. No EPSS data was provided in the input; KEV status is not listed, and no public proof-of-concept has been identified. The 'Denial Of Service' tag in the input metadata is secondary - the stated primary impact is local privilege escalation (EoP), which is consistent with a UAF primitive that can be leveraged for controlled object substitution rather than simple crash. The breadth of affected Windows versions (15 distinct builds from Server 2016 to Windows 11 26H1) expands real-world exposure significantly. Risk is elevated in shared-access environments such as terminal servers, VDI, and multi-user workstations where low-privileged local accounts are the normal attack surface.

An attacker with a low-privileged local account on a Windows host - for example via an RDP session or an already-compromised standard user account - races a crafted sequence of device-pairing IPC requests to the Device Association Service to trigger a use-after-free condition. By winning the race and placing a controlled object in the freed memory region, the attacker redirects service execution to shellcode or a privileged function, elevating to SYSTEM. No public proof-of-concept has been identified at time of analysis.