Device Association Service CVE-2026-85904

Exploitation requires local access to the host as an already-authenticated low-privileged user (PR:L) who can invoke Windows Device Association Service (DAS) operations; there is no remote or network path and no user interaction by a victim is involved. The key limiting factor is high attack complexity (AC:H): the attacker must win a timing-dependent race against the service's improper synchronization of a shared resource, which is not deterministic and generally needs repeated attempts. Realistic exposure is highest on multi-user systems where untrusted principals hold local sessions - terminal/RDP servers, shared build or CI agents, and shared workstations - and is minimal on single-user endpoints where no untrusted local account exists.

This is a genuine but moderate-priority elevation-of-privilege vulnerability, not a high-urgency remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) is internally consistent with the description: local attack vector, high attack complexity (inherent to winning a race-condition timing window), and low privileges already required. The high attack complexity is the dominant limiting factor - reliably winning the synchronization race is non-trivial and typically requires multiple attempts. No EPSS score, KEV listing, or public POC was provided in the input, and exploitation status is therefore 'no public exploit identified at time of analysis'; absence of these signals is not proof of safety but does indicate this is not currently in mass exploitation. Because PR:L is present, exploitation is authenticated - an attacker must already have a foothold as a low-privileged local user. Net assessment: a solid patch-in-normal-cycle item for workstations and multi-user servers, elevated in priority only where untrusted users share a host (RDP/terminal servers, shared build agents). The 'Information Disclosure' tag conflicts with the description and full C:H/I:H/A:H impact, which describe elevation of privilege - treat the tag as suspect.

A local, already-authenticated low-privileged user (or malware running in a low-integrity context) repeatedly triggers Device Association Service operations to exploit the improper synchronization window, racing to corrupt or reuse a shared resource and gain SYSTEM-level execution. No public exploit code was identified at time of analysis, and the high attack complexity means success likely requires many timed attempts rather than a single deterministic trigger.