Device Association Service CVE-2026-85331

Exploitation requires the attacker to already possess valid, low-level privileges on the target (CVSS PR:L) and network reachability to the Windows Device Association Service (the component managing device pairing/association). The specific limiting factors are: the attacker must be authenticated/authorized (no anonymous exploitation), and the only outcome is disclosure of memory contents from the Device Association Service process - no code execution, data modification, or service disruption is possible (I:N/A:N). No end-user interaction is needed (UI:N). The flaw affects default Windows installations across the listed client and server builds below the patched versions, but the PR:L requirement and read-only impact substantially limit realistic risk.

This is a moderate-severity information-disclosure flaw whose signals are internally consistent and point to low real-world urgency despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) shows a network-reachable, low-complexity bug that nonetheless REQUIRES privileges (PR:L), so exploitation is by an authenticated/authorized attacker, not an anonymous remote one. Impact is confidentiality-only (C:H, with I:N/A:N), matching the CWE-125 out-of-bounds read and the description's 'disclose information' wording - there is no code execution or integrity/availability impact. CISA's SSVC framework reinforces low priority: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV; no public exploit code is referenced. The signals do not conflict - a 'C:H' confidentiality rating on an OOB read looks high, but SSVC's 'partial' technical impact tempers this, suggesting bounded memory disclosure rather than total compromise. Bottom line: a genuine but lower-tier patch-management item, not an emergency; the PR:L requirement and absence of exploitation evidence make it a routine Patch-Tuesday-class fix rather than a drop-everything priority.

An attacker who already holds a low-privileged authenticated foothold on or network access to an affected Windows host sends specially crafted input to the Device Association Service, triggering an out-of-bounds read. The service returns adjacent process-memory contents, potentially leaking sensitive data such as pointers, tokens, or configuration fragments useful for further attacks. No public exploit code is identified at time of analysis, and the attack is not automatable per CISA SSVC.