Windows Cdpsvc EUVD-2026-73003

Exploitation requires an existing local authenticated session with at minimum standard (low-privilege) user rights - PR:L per CVSS. The attacker must be able to execute code locally on the affected Windows system (AV:L). The high attack complexity (AC:H) indicates that exploitation is not straightforward: reliable triggering likely depends on precise timing or a specific heap state in the Cdpsvc process, meaning automated or scripted mass exploitation is constrained. No user interaction beyond the attacker's own session is required (UI:N). The Connected Devices Platform Service must be running, which is the default state on consumer and enterprise Windows installations. No non-default configuration is specified as prerequisite. What limits exploitation: requirement for an existing local foothold; AC:H race/timing constraint reducing reliability; no remote attack vector.

The CVSS 7.0 score reflects a meaningful but conditional risk: the AV:L requirement restricts exploitation to attackers who already have a foothold on the target system, and AC:H signals that reliable exploitation requires either precise timing, heap grooming, or specific service state conditions. This positions the vulnerability firmly in the post-exploitation, privilege-escalation category - valuable to attackers who have achieved initial code execution as a standard user but need SYSTEM-level access to proceed. No KEV listing and no public POC have been identified, which reduces the near-term risk of opportunistic exploitation. However, the broad Windows footprint means the absolute exposure is large even if per-system probability is moderated by AC:H. The scope is contained (S:U), and no scope change affecting other security principals is described. A mid-sized IT team operating on an unpatched Windows estate should treat this as a prioritized patch-cycle item given the complete C:H/I:H/A:H impact upon successful exploitation, even absent active exploitation evidence.

A standard-user account on a Windows endpoint executes a locally compiled payload that triggers a race condition in Cdpsvc, causing the service to access freed memory controlled by the attacker. By placing crafted data at the reclaimed heap location, the attacker redirects execution to shellcode or overwrites a privilege token, obtaining SYSTEM-level access on the host. No public exploit code has been identified at time of analysis, but the technique class (UAF with race condition) is well-understood by advanced threat actors.