Windows Device Install Service EUVD-2026-100003

Exploitation requires local access to an affected Windows host with at least low-level privileges (PR:L) - the attacker must already be able to execute code as an authenticated standard user, so this is a post-foothold escalation rather than remote exploitation. The specific trigger is the Windows Device Install Service performing an incorrect authorization check (CWE-863); the description does not require any non-default configuration or user interaction (UI:N), meaning default installations are affected. Limiting factors that reduce real-world risk: there is no remote/network vector (AV:L), the attacker needs valid local credentials or an existing foothold, scope is unchanged (S:U), and SSVC indicates it is not automatable.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) rooted in incorrect authorization (CWE-863) within the Windows Device Install Service. The CVSS vector confirms an authenticated low-privileged local attacker (PR:L) can achieve full confidentiality, integrity, and availability impact (C:H/I:H/A:H) with low attack complexity and no user interaction. Multiple exploitation signals agree that this is NOT an urgent emergency: CISA SSVC rates Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit code was identified in the provided data - consistent with a low (though not provided numerically) real-world exploitation likelihood. Counterbalancing that, SSVC Technical Impact is 'total', matching the C:H/I:H/A:H triad, and a vendor patch is available, so this is a genuine patch-worthy local privilege-escalation primitive rather than a false-positive high-CVSS issue. The realistic priority is medium: it requires the attacker to already have a foothold with valid low-privileged credentials on the host, so it is a post-compromise escalation step (useful in chained attacks) rather than a remotely-wormable threat. EPSS score was not provided in the input and should be checked to refine prioritization.

An attacker who has already gained an unprivileged foothold on a Windows host - for example via phishing, a stolen standard-user credential, or a compromised service account - invokes the Windows Device Install Service and abuses its incorrect authorization check to run code or operations at SYSTEM/elevated privilege. No user interaction is required and attack complexity is low, but local access with at least low privileges is mandatory. No public proof-of-concept exploit was identified at the time of analysis.