Windows EUVD-2026-73522

The attacker must possess a valid low-privilege account with the ability to execute code locally on the target system (PR:L, AV:L). No user interaction is required beyond initial access. High attack complexity (AC:H) indicates that exploitation is not straightforward - it likely requires a precise race condition or heap-grooming sequence to reliably trigger the use-after-free. The Device Association Service must be running, which is the default on desktop and server SKUs that support device pairing; Server Core environments running Server 2012 R2 or later are also explicitly listed as affected. Exploitation is blocked for fully remote, unauthenticated attackers since local execution rights are a hard prerequisite.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N reflects a meaningful but operationally constrained threat: an attacker must already hold a local account with limited privileges, and exploitation requires navigating a high-complexity condition (likely a race or precise heap-grooming sequence). Despite the high C:H/I:H/A:H impact, the AC:H modifier substantially reduces real-world risk compared to a straightforward LPE. No public exploit code has been disclosed and the CVE is not listed in the CISA KEV catalog, suggesting no confirmed in-the-wild exploitation at time of analysis. Nonetheless, LPE vulnerabilities in widely-deployed Windows services are attractive post-compromise stepping stones: ransomware operators and APT groups routinely chain LPE bugs to pivot from a compromised user account to SYSTEM, so even a mid-sized IT shop should treat this as a priority patch. EPSS data is not available in the input, but the absence of KEV and POC together with AC:H keeps real-world exploitability moderate rather than critical.

An attacker with a standard low-privilege domain or local user account on a target Windows system triggers a race condition in the Device Association Service, causing a heap object to be freed while a pointer to it remains live. By timing a concurrent allocation to reclaim the freed buffer with attacker-controlled data, the attacker redirects execution to shellcode or a ROP chain, elevating the process to SYSTEM. No public proof-of-concept has been identified, and AC:H in the CVSS vector reflects the precision required to win the race reliably.