EUVD-2026-73587
GHSA-x78q-wmvf-c2ff
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF race condition (AV:L/AC:H) requires a standard user account (PR:L); successful exploitation yields full SYSTEM-level compromise (C:H/I:H/A:H) with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Device Association Service across all currently supported Windows 10, Windows 11, and Windows Server 2019/2022/2025 editions is caused by a use-after-free (CWE-416) memory corruption flaw in the component responsible for managing logical device pairings (Bluetooth, Wi-Fi Direct, MTP, NFC). An attacker holding a standard local user account can exploit a dangling-pointer dereference - likely by racing concurrent device association events - to gain code execution at an elevated privilege level with full confidentiality, integrity, and availability impact on the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, authenticated account with at minimum standard user privileges (PR:L per CVSS) on an unpatched Windows host where the Device Association Service is running - the service is enabled by default on all supported Windows desktop and server editions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately represents the threat model: local access is required (AV:L), a low-privileged account is sufficient (PR:L), and race-condition exploitation adds meaningful complexity (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches distributed through Windows Update, Windows Server Update Services, or the Microsoft Update Catalog; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69866 is authoritative. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Windows 10, 11, Windows Server 2019, 2022, and 2025 systems across your environment to establish baseline exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today