Windows EUVD-2026-73541

Exploitation requires a local authenticated session with at least standard (low-privilege) user rights on the target system - PR:L in the CVSS vector confirms this. The race condition (CWE-362) imposes AC:H: the attacker must win a specific timing window in the Device Association Service's concurrent memory management, making reliable exploitation dependent on thread-scheduling conditions that vary by system load and CPU count. No special Windows features, non-default configuration, or elevated privileges beyond a standard user logon are required. Exploitation is limited to: (1) local access only - no network vector exists (AV:L); (2) successful race-condition timing - repeated attempts may be needed; (3) physical or authenticated remote desktop/terminal server access to the target host.

CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is consistent with the described attack: maximum confidentiality, integrity, and availability impact attainable by a low-privileged local user, offset by high attack complexity (the race window must be reliably won). No EPSS data was provided, KEV status is negative, and no public exploit code is known at time of analysis - these signals collectively suggest this is not yet being actively weaponized in the wild. However, the real-world risk is non-trivial: Windows is ubiquitous in enterprise environments where insider threats, compromised service accounts, or post-phishing lateral movement scenarios routinely involve a low-privileged local foothold that needs elevation. Race-condition UAF primitives in privileged Windows services have a well-established exploitation track record (e.g., win32k and similar prior art). The combination of broad version coverage, vendor patch availability, and high post-exploitation impact makes this a patch-cycle priority even in the absence of active exploitation evidence.

An attacker who has already obtained a standard (low-privileged) local user account - through phishing, credential theft, or remote exploitation of a separate vulnerability - launches a multi-threaded tool that repeatedly triggers concurrent operations against the Windows Device Association Service to win a race condition on a shared object. Upon successfully freeing and reusing the target memory, the attacker redirects execution to shellcode or a ROP chain running under the service's higher-privileged context, achieving SYSTEM-level code execution. No public proof-of-concept exists at time of analysis, but the exploitation technique is well-understood from similar Windows service race-condition UAFs.