Windows Cdpsvc EUVD-2026-100277

Exploitation requires the attacker to already hold valid local, low-privileged access to the target (PR:L, AV:L) - this is not remotely reachable. The specific prerequisite is the ability to interact with the Connected Devices Platform Service (Cdpsvc), which is present and running by default on the listed Windows builds, so no special non-default configuration is needed to reach the vulnerable code. The key LIMITING factor is high attack complexity (AC:H): the double free depends on winning a race condition, so exploitation requires precise timing and likely multiple attempts, reducing reliability. No user interaction is required (UI:N). Affected and unpatched builds include Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 below the fixed revisions listed in the EUVD data.

This is a locally-exploitable elevation-of-privilege flaw (CWE-415 double free) in the Connected Devices Platform Service, scored 7.0 (HIGH). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: AV:L and PR:L mean an attacker must already have local, low-privileged authenticated access, and AC:H reflects the race/timing precision typically required to win the double-free window. The C:H/I:H/A:H impact indicates successful exploitation yields full SYSTEM-level control. No EPSS score, CISA KEV listing, or POC/exploit-code signal was provided in the input, so there is no evidence of active exploitation or public tooling - this reads as a credible but not-yet-urgent patch-cycle priority rather than an emergency. The real-world risk is moderated by two factors (local access prerequisite and high attack complexity) but amplified by one (the affected service is present on virtually every modern Windows system). Note a data conflict: the input Tag says 'Information Disclosure' while the description and vector describe a privilege-escalation/memory-corruption bug - the tag appears mislabeled and the EoP framing should be treated as authoritative.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised limited service) repeatedly triggers the Cdpsvc code path to win a race that causes the same memory to be freed twice, corrupting the heap. By grooming the heap to reclaim the freed allocation, they redirect execution to run their code at SYSTEM. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) means reliable exploitation requires precise timing.