Device Association Service CVE-2026-83710

Exploitation requires local access with an existing authenticated low-privileged account on the Windows host (AV:L, PR:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. No user interaction is needed (UI:N). The key limiting factor is high attack complexity (AC:H): as a use-after-free (CWE-416), reliable exploitation depends on winning a race condition or achieving a specific memory state in the Device Association Service, which is not deterministic and resists automation (SSVC Automatable: no). The target is the Device Association Service, which is present in default Windows installations across the listed desktop and server builds, so no special non-default feature needs to be enabled, but a successful attacker must already be able to execute code on the machine.

Signals here are largely consistent and point to a moderate, not urgent, priority. The CVSS 3.1 base score of 7.0 is driven by total impact (C:H/I:H/A:H) but tempered by a local attack vector (AV:L), high attack complexity (AC:H, typical of a use-after-free that requires winning a race or precise memory grooming), and the requirement for existing low-level privileges (PR:L). CISA's SSVC framework reinforces this: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AV:L/AC:H - it cannot be sprayed at scale), while Technical Impact is 'total' (consistent with a SYSTEM-level privilege escalation). KEV status is not present in the input, so this is not confirmed actively exploited. No EPSS score and no POC indicator were supplied. There is no conflict between the signals: this reads as a genuine local privilege-escalation primitive useful as a post-compromise step, but with no evidence of real-world exploitation and meaningful exploitation difficulty, so it should be patched on a normal prioritized cycle rather than treated as an emergency. Note one metadata oddity: the description and CVSS describe a privilege-escalation (EoP) use-after-free, yet the input Tags include 'Denial Of Service' - verify against the Microsoft advisory, as the primary impact per the description is elevation of privilege.

A local attacker who has already obtained a low-privileged foothold on a Windows host (for example via phishing or a compromised standard user account) interacts with the Device Association Service to trigger a use-after-free, corrupting kernel/service memory to hijack execution. By winning the required race condition they coerce the service into running attacker-controlled logic at SYSTEM, completing a local privilege escalation. No public exploit was identified in the provided data, and the high attack complexity means successful exploitation is non-trivial.