Windows EUVD-2026-73012

The attacker must have local interactive or remote desktop access to the target system with at least a low-privileged (non-guest) account - the CVSS PR:L metric confirms this prerequisite. The Windows Device Association Service must be running, which is the default state on all affected Windows editions. High attack complexity (AC:H) indicates a race condition that requires precise timing and may need multiple attempts, limiting reliability. No network-facing attack surface is involved (AV:L); exploitation is fully local. There is no user interaction requirement (UI:N). The flaw is not limited to a non-default configuration - any unpatched system with a local account is potentially vulnerable.

The CVSS 7.0 score accurately reflects the constrained exploitation environment: local access and high attack complexity both narrow the realistic attacker population compared to network-reachable, low-complexity vulnerabilities. The AC:H metric, consistent with a race-condition UAF, means exploitation is not trivially reliable and may require multiple attempts. However, the C:H/I:H/A:H impact triad confirms that a successful exploit yields complete system compromise, making this a meaningful post-initial-access escalation primitive. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, which further moderates urgency. The extremely broad Windows footprint - spanning consumer, enterprise, and server editions - means the absolute number of potentially exposed hosts is large even if individual exploitation difficulty is elevated. EPSS data was not supplied in the input, so probabilistic exploitation likelihood cannot be assessed from available data.

A low-privileged user logged into a Windows endpoint triggers a race condition in the Device Association Service by issuing rapid concurrent device-pairing requests, freeing and reallocating a service-internal object to land attacker-controlled data in the freed memory region. Once the use-after-free is triggered successfully, the attacker redirects execution flow within the privileged service process, gaining SYSTEM-level code execution. No public proof-of-concept code has been identified, but UAF race conditions are a well-understood exploit primitive with documented techniques in the Windows research community.