Windows EUVD-2026-56371

Exploitation requires a valid local user account on the target Windows system (PR:L per CVSS vector) - a standard, non-administrator account is sufficient. The attacker must be able to execute code locally on the affected machine, which can be achieved via RDP, interactive logon, or through a separate initial-access vector. No user interaction from another account is required (UI:N). No specific non-default configuration of the Device Association Service is stated as a prerequisite in the available data, suggesting the service's default running state is sufficient. Exploitation is limited to local attack scenarios (AV:L) - remote unauthenticated exploitation is not possible based on the CVSS vector. The scope is unchanged (S:U), meaning the attacker escalates privileges within the same system boundary rather than pivoting to another component.

The CVSS 7.8 score is driven by AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local exploitation by a standard user with low complexity and no user interaction, yielding full-system impact. The low attack complexity is the key signal here: this is not a race condition or environment-dependent flaw but a straightforward memory corruption primitive requiring only a local account, making it highly reliable for post-exploitation privilege escalation. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present and no public POC has been identified, suggesting exploitation has not yet been observed at scale. However, local privilege escalation vulnerabilities in core Windows services are extremely valuable in attack chains - particularly in RDP-accessible environments, multi-tenant terminal servers, or post-phishing scenarios where an attacker lands as a domain user. The breadth of affected Windows versions (15 SKUs spanning a decade of releases) significantly expands the attack surface. Real-world priority is high for any environment where attackers may obtain initial local access, even via unprivileged accounts.

An attacker who has obtained a low-privileged local account - for example, via a phishing-delivered payload, a compromised domain user credential used over RDP, or a separate initial-access vulnerability - sends crafted input to the Windows Device Association Service, triggering the heap buffer overflow. The attacker corrupts heap control structures to redirect the service's execution flow, achieving arbitrary code execution in the context of the service's privileged account, and escalates from standard user to SYSTEM. No public exploit code has been identified at time of analysis, but the AC:L rating indicates this is a low-complexity exploitation path.