EUVD-2026-99451
GHSA-w97f-572h-pwrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local access
-
DeliveryInteract with Device Association Service
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold valid low-privilege local credentials/session on the Windows host (PR:L, AV:L) and to interact with the Device Association Service to trigger the heap overflow. Exploitation is further limited by high attack complexity (AC:H) - characteristic of heap-overflow bugs needing precise heap layout or a race condition - which means reliable exploitation is non-trivial and not automatable (SSVC Automatable: no). No user interaction is required (UI:N). Highest-risk deployments are shared/multi-user systems (terminal servers, RDP hosts) where untrusted low-privilege users can run code; single-user workstations with no untrusted local accounts face lower practical exposure. |
| Impact | This is a moderate-priority local privilege escalation that is unlikely to be mass-exploited in the near term. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) shows the attacker must already have local, authenticated (low-privilege) access AND overcome high attack complexity (AC:H) - typically a heap-grooming/race or specific-state requirement inherent to heap overflow exploitation. All three signals that would raise urgency are absent or low: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code is identified. These agree with a low EPSS-style expectation and together indicate this is NOT a drop-everything issue. The counterweight is technical impact: SSVC rates it 'total' and the vector shows full C:H/I:H/A:H (SYSTEM-level compromise if exploited), which is why the base score is 7.0 (High) despite the access and complexity barriers. No signals are directly conflicting, but note that CVSS and SSVC agree the real-world risk is bounded by the local-access + high-complexity + low-automatability profile. Treat as a standard patch-cycle item for Windows fleets, prioritized on multi-user/terminal-server hosts where untrusted low-privilege users exist. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a Windows host - for example via phishing, a compromised standard user account, or a prior low-impact bug - triggers the heap-based buffer overflow in the Device Association Service to corrupt heap memory and gain SYSTEM privileges. Because attack complexity is high (AC:H), the attacker likely must win a race or achieve a specific heap state, so exploitation is not trivial. No public proof-of-concept or exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Device Association Service (DeviceAssociationService) allows an attacker who already holds a low-privilege local session to corrupt heap memory and elevate to SYSTEM. Successful exploitation requires a crafted interaction with the service to trigger a heap buffer overflow (CWE-122); the assessed vector (AV:L/AC:H/PR:L/UI:N) confirms an authenticated local attacker with no user interaction, but high attack complexity makes reliable exploitation non-trivial, and no public exploit code has been identified at time of analysis (SSVC Exploitation: none, Automatable: no). This is a moderate-priority, non-mass-exploitable local privilege escalation; the practical risk concentrates on shared, multi-user hosts such as terminal servers and RDP jump boxes where untrusted accounts can run code, while single-user workstations with no untrusted local users face low practical exposure. A vendor patch is available from Microsoft.
RemediationAI
Microsoft has released vendor patches for this issue; apply the security update for your build through Windows Update, WSUS or the Microsoft Update Catalog, using the fixed build numbers in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-84014) as the target baseline - for example Windows 11 24H2 to 10.0.26100.9711 or later, Windows 11 25H2 to 10.0.26200.9711 or later, Windows Server 2022 to 10.0.20348.5761 or later, Windows Server 2025 to 10.0.26100.33650 or later, and Windows Server 2012 R2 to 6.3.9600.23470 or later. Because exploitation is purely local and requires an already-authenticated low-privilege session, network-layer controls are not effective; the highest-value compensating control if patching must be deferred is to reduce the population of untrusted local users on exposed hosts - remove or restrict interactive/RDP logon rights on terminal servers, RDP hosts and multi-session systems where low-privilege users can execute code (a configuration change that impacts legitimate remote workers and should be staged). Disabling the Device Association Service (DeviceAssociationService) removes the attack surface entirely, but as a trade-off it breaks device pairing and discovery workflows such as Bluetooth peripheral association, Wi-Fi Direct and Miracast/display projection, and should only be applied on hardened servers that do not require those capabilities. Additional hardening includes enforcing least privilege and Credential Guard / LSA protection so that any successful local escalation yields less durable access, and monitoring for unexpected service crashes or heap-corruption-induced process terminations in DeviceAssociationService as a potential exploitation signal; note that no public exploit code has been identified at time of analysis, so signature-based detection options are limited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Device Association Service, the Windows service that brokers associations between the host and paired or discoverable devices - Bluetooth peripherals, Wi-Fi Direct, Miracast/display projection and similar device-pairing workflows. The root cause is a heap-based buffer overflow (CWE-122), meaning data supplied through the service's local interface (RPC/ALPC or IOCTL-driven association metadata) is written past the bounds of a heap allocation without adequate length or structure validation, allowing an attacker to overwrite adjacent heap metadata or objects. Because the vulnerable code runs inside a privileged service, a corrupted heap object can be leveraged to redirect execution and obtain SYSTEM-level privileges within the same security scope (S:U) at full impact to confidentiality, integrity and availability (C:H/I:H/A:H). The high attack complexity (AC:H) reflects the exploitation reality of heap corruption: the attacker must shape the heap precisely, and the bug may exhibit race-condition or non-deterministic behavior, so a stable, repeatable exploit is difficult to construct and not automatable per CISA's SSVC assessment. The Windows builds listed by ENISA EUVD span the entire currently supported servicing train - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server (2012 R2, 2016 including Server Core, 2019 including Server Core, 2022, 2025 including Server Core) - confirming that the vulnerable binary is shared broadly across client and server SKUs rather than limited to a single edition.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an existing low-privilege session (PR:L, AV:L); heap-overflow exploitation implies AC:H, and success yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft's Windows Device Association Service carries a heap-corruption vulnerability (CVE-2026-84014) that allows a user who already holds a low-privilege local session to escalate to full SYSTEM control on the affected host. The real business exposure sits with shared, multi-user systems - terminal servers, RDP jump boxes and VDI hosts - where a single untrusted or compromised account can become a springboard to full control of a platform many other users depend on, while single-user workstations face limited practical risk. Because exploitation requires an existing local foothold, a high-complexity trigger, and no public exploit code has been identified at time of analysis, this is a prioritization-driven patching item rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB