Azure Attestation EUVD-2026-56771

Exploitation requires network reachability to either the Azure Attestation cloud endpoint or the Device Health Attestation Service endpoint. The CVSS vector PR:N confirms no authentication or credentials are required. AC:H indicates that exploitation is not straightforward - the attacker must satisfy specific conditions related to triggering the integer overflow at the correct boundary, likely requiring careful crafting of input size or count fields. No specific non-default configuration is documented as a prerequisite. Limiting factors include: (1) high attack complexity reducing opportunistic exploitation; (2) Azure Attestation is not universally deployed - only environments using TPM, SGX, or VBS-based attestation are exposed; (3) Device Health Attestation is primarily used in enterprise Windows MDM environments. Exploitation of the cloud service may be constrained by Microsoft's own network-layer protections.

The CVSS 3.1 base score of 8.1 (High) reflects a network-reachable, unauthenticated RCE with C:H/I:H/A:H impact - a severe outcome - tempered by AC:H (high attack complexity), which materially reduces exploitability in opportunistic scenarios. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. KEV status is absent, meaning CISA has not confirmed active exploitation. No POC is known. The AC:H rating is technically significant: heap-based buffer overflows stemming from integer overflows typically require control over specific input values, timing, or memory layout to achieve reliable code execution, making mass exploitation less likely than a network-reachable AC:L vulnerability. However, a motivated, capable threat actor targeting Azure Attestation infrastructure - which underpins device trust decisions in enterprise MDM and zero-trust architectures - would have strong incentive to develop a working exploit. The dual-service scope (cloud and on-premises MDM) broadens the potential attack surface. Assessment: elevated real-world priority for enterprises using Azure device attestation or Windows MDM, but not an imminent mass-exploitation threat based on currently available signals.

An unauthenticated remote attacker sends a specially crafted network request to the Azure Attestation or Device Health Attestation Service endpoint, triggering an integer overflow in a size calculation during input parsing. The resulting undersized heap buffer is overwritten with attacker-controlled data, achieving arbitrary code execution in the context of the service process. No public POC is available at time of analysis, but the high attack complexity (AC:H) indicates a skilled attacker would need to engineer specific heap memory conditions to achieve reliable code execution.