Device Association Service CVE-2026-96854

Exploitation requires the attacker to already have authenticated local access to the Windows host with at least low-level user privileges (CVSS PR:L, AV:L); it cannot be triggered remotely or by an unauthenticated user. The attacker must be able to interact with the Device Association Service (the component that manages pairing/association of external devices) to supply the incompatible-type input that triggers the CWE-843 type confusion. No user interaction by a victim is required (UI:N). The impact is limited to information disclosure only (C:H, I:N, A:N) - it does not by itself grant code execution, data tampering, or denial of service. The need for a pre-existing local foothold is the primary limiting factor on real-world risk.

This is a moderate-severity local information disclosure flaw (CVSS 5.5) that is a genuine but non-urgent priority. All exploitation signals point the same direction: the CVSS vector (AV:L/AC:L/PR:L/UI:N) requires local access and existing low-level privileges, meaning an attacker must already be authenticated on the host before this can be used - it is not a remote entry point. CISA's SSVC decision framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial, which is internally consistent with the local, privileged, confidentiality-only nature of the bug. There is no CISA KEV listing, no public POC, and no EPSS score was supplied in the input (EPSS data missing - cannot weigh exploitation probability quantitatively). The signals do not conflict: a type-confusion (CWE-843) bug yielding only information disclosure (C:H, I:N, A:N) on a local, already-authenticated attack surface is a realistic post-compromise privilege/secrets-harvesting primitive rather than a mass-exploitation threat. Treat it as routine patch-cycle remediation, not emergency response.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., a standard local user or malware running in a user context) interacts with the Device Association Service to trigger the type confusion and read memory the attacker should not be able to access, disclosing sensitive information from the service's address space. No public exploit code has been identified, and exploitation requires local access with existing privileges, so this is a post-compromise escalation/harvesting step rather than an initial-access vector.