Windows MDM EUVD-2026-73513

Exploitation requires the attacker to hold a low-privileged authenticated account (PR:L) with network access to the target Windows MDM endpoint. High attack complexity (AC:H) implies the attacker must achieve precise heap layout conditions typical of use-after-free exploitation - likely involving timing or spray techniques. User interaction (UI:R) means a legitimate user on the target system must perform some MDM-related action (such as triggering an enrollment check or policy refresh) during the attack window; this cannot be fully forced by the attacker remotely. The MDM service must be active and reachable over the network. Purely unauthenticated or fully automated exploitation is excluded by the PR:L and UI:R constraints. Exploitation against Server Core variants follows the same conditions since the MDM component is present in those builds.

The CVSS 7.1 score with AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H captures a nuanced risk profile: while the full C/I/A triad signals complete privilege compromise once exploited, the AC:H and UI:R constraints substantially raise the bar for successful exploitation, requiring precise heap manipulation and synchronization with a legitimate user action. No EPSS score was provided in the input, and the absence of a CISA KEV listing means active exploitation in the wild is unconfirmed. Even a mid-sized municipal IT team in sopot should treat this as urgent given the breadth of affected Windows versions and the SYSTEM-level impact of successful exploitation, but the real-world exploitation likelihood is lower than a straightforward unauthenticated RCE. POC availability is unknown; the 'Denial of Service' tag in the input metadata understates the primary risk - the description explicitly describes privilege escalation supported by C:H/I:H, not merely availability impact.

An attacker with a low-privileged domain or local account sends specially crafted MDM protocol messages to trigger a use-after-free condition in the Windows MDM component while coordinating with a legitimate user performing an MDM operation (such as an enrollment or policy sync). By exploiting the freed heap object reference, the attacker corrupts memory to redirect execution and achieves SYSTEM-level privilege escalation on the target machine. No public proof-of-concept is known, and the high attack complexity requirement means this technique is more consistent with targeted intrusion than opportunistic mass exploitation.