Device Association Service CVE-2026-70227

Exploitation requires the attacker to already possess local, authenticated access to the Windows host with at least low-level privileges (PR:L) and the ability to interact with the Windows Device Association Service, which handles device pairing/association. There is no remote vector (AV:L) and no user interaction is needed (UI:N). Limiting factors: the attacker must have an existing foothold on the machine, impact is confined to information disclosure (C:H, I:N, A:N) with unchanged scope (S:U), and the affected service is the local Device Association Service rather than a network-facing component - so this cannot be triggered remotely and yields no direct code execution or integrity/availability impact on its own.

This is a moderate, low-priority issue that the signals consistently agree on - there is no conflict here. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a locally-exploitable, authenticated information-disclosure flaw with no integrity or availability impact; the C:H reflects that an out-of-bounds read could surface sensitive memory contents, but the local vector and required privileges sharply limit reach. CISA's SSVC framework corroborates low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (local, non-wormable), Technical Impact=partial. There is no CISA KEV listing and no EPSS score was supplied, and no POC was identified, so exploitation status is 'no public exploit identified at time of analysis.' All available signals point the same direction - a genuine but low-severity local infoleak, not an urgent remotely-exploitable priority. Patch deploying through normal Microsoft update cycles is the appropriate response rather than emergency action. Note: no EPSS probability was provided in the input, so the quantitative exploitation-likelihood dimension cannot be independently assessed.

An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) interacts locally with the Device Association Service to trigger an out-of-bounds read, causing the service to return adjacent process memory. The disclosed bytes could contain pointers, tokens, or other sensitive data useful for escalating a broader intrusion. No public exploit code was identified, and exploitation requires prior local access and valid privileges.