Windows CVE-2026-77500

Exploitation requires a locally authenticated account with at minimum standard (low-privilege) user rights on an affected Windows build - confirmed by CVSS PR:L. The Device Association Service must be running, which is the default state on all listed Windows versions; no non-default configuration or feature enablement is required. Exploitation is strictly limited to local attack vector (CVSS AV:L): remote unauthenticated exploitation is not possible. The attacker must already have the ability to execute code as a normal user on the target system - for example via phishing, malware delivery, or insider access - before leveraging this vulnerability to escalate privileges. No specific hardware device, peripheral, or pairing session is described as required.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (score 7.8) accurately reflects a realistic local privilege escalation: low-privilege local access is sufficient, no complexity barrier, and no user interaction is required, meaning a working exploit would be highly reliable once developed. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, so exploitation remains theoretical at time of analysis. However, the AC:L/UI:N combination combined with the default-enabled nature of the Device Association Service across all listed Windows versions means the attack surface is broad - any organization running a large mixed fleet of unpatched Windows 10 and Server 2016/2019 systems faces meaningful insider-threat and post-compromise lateral-movement risk. EPSS data was not provided in the source intelligence, so statistical exploitation probability cannot be quantified. The invalid pointer release class (CWE-763) has historically been converted into reliable privilege-escalation primitives in Windows services. Patching should be prioritized alongside other local-privilege-escalation fixes in the same update cycle.

An attacker with a standard local user account on an unpatched Windows 10 or Windows Server 2019 system sends a crafted device-association request to the Device Association Service, triggering the invalid pointer release in the vulnerable code path. The resulting memory corruption allows the attacker to redirect execution flow within the service process and elevate to SYSTEM-level privileges without any additional user interaction. From SYSTEM, the attacker can install persistent backdoors, dump credential stores, disable security tooling, or pivot laterally across the network.