Windows EUVD-2026-73884

The attacker must have an authenticated local session on the target Windows system with at least standard user (low-privilege) rights - this is the PR:L requirement in the CVSS vector. The vulnerability is in the Device Association Service, which is enabled by default on all affected Windows desktop and server builds and handles Bluetooth/Wi-Fi Direct pairing; no non-default configuration is required to expose it. The AC:H rating reflects that the attacker must win a race condition to reliably trigger and exploit the use-after-free before the service recycles the freed memory with uncontrolled data. Remote unauthenticated exploitation is not possible - AV:L requires physical or terminal-session local access. Exploitation is further limited by the need to precisely time the free/reuse race, which typically requires repeated attempts or heap spray techniques.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic picture: exploitation is local-only and requires already-holding a low-privileged account, while the AC:H rating captures the race-condition hurdle that an attacker must reliably win. Even a mid-sized municipal IT team in bytom should treat this as urgent, because LPE primitives of this class are reliably chained with initial-access exploits (e.g., phishing droppers) to complete full domain compromise. EPSS data is not present in the input; KEV status is negative and no public POC is known, both of which reduce immediate mass-exploitation risk. However, the breadth of affected versions - covering every supported Windows SKU - means the attack surface is enormous, and Microsoft's own MSRC reporting of the issue suggests internal or researcher-class discovery rather than opportunistic weaponization at this time. SSVC assessment: exploitation not active, technically impactful (C:H/I:H/A:H), not automatable (race condition + local access required); priority is Attend for patch deployment during next maintenance window.

An attacker with a low-privileged Windows account (e.g., obtained via phishing or credential theft) triggers a race condition in the Device Association Service by initiating concurrent device-pairing operations, causing a heap object to be freed while a callback still holds a reference. By racing an attacker-controlled allocation into the freed slot before the dangling pointer is dereferenced, the attacker redirects execution and achieves SYSTEM-level code execution. No public proof-of-concept code is currently known, and the AC:H complexity rating means reliable exploitation requires careful timing or heap grooming.