Windows CDPSvc EUVD-2026-99190

Exploitation requires the attacker to already have an authenticated local account with at least low-level privileges on the target (PR:L, AV:L) - this is not remotely or anonymously exploitable. The attacker must interact with the Windows Connected Devices Platform Service (CDPSvc) and win a race condition by timing concurrent access to an improperly synchronized shared resource; the high attack complexity (AC:H) reflects that this timing window is narrow and not reliably controllable, likely requiring repeated attempts. No special user interaction is needed (UI:N). The service is present by default on supported Windows editions, so no non-default configuration is required; the principal limiting factors are the prerequisite local authenticated access and the inherent unreliability of exploiting a race condition.

This is a genuine but moderate-priority local privilege escalation in the Windows Connected Devices Platform Service (CDPSvc), scored CVSS 7.0 (High). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N tempers the raw score meaningfully: exploitation is local (AV:L), requires an attacker to already hold low-level authenticated privileges on the host (PR:L), and is of high attack complexity (AC:H) because winning the race condition (CWE-362) depends on precise timing of concurrent access to a shared resource, which is not reliably controllable. Offsetting that, the impact is total - C:H/I:H/A:H with scope unchanged means a successful win yields full SYSTEM-level compromise of the local machine. No EPSS score, SSVC decision point, POC reference, or CISA KEV entry was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only reference is the Microsoft MSRC advisory. Weighing the signals, this is a credible post-compromise/lateral-escalation tool rather than an initial-access or wormable threat: the local vector plus required privileges plus timing difficulty keep real-world urgency below that of a network-facing unauthenticated flaw, even though the product (Windows) is ubiquitous. Prioritize via normal Patch Tuesday cadence, raising priority on multi-user or shared endpoints where untrusted low-privilege users log in.

A low-privileged but authenticated user (or malware running in that user's context) on a Windows machine repeatedly triggers concurrent operations against the Connected Devices Platform Service to hit a narrow timing window in its improper synchronization. Winning the race corrupts shared state and lets the attacker execute code or manipulate a resource as SYSTEM, achieving full local privilege escalation. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) means exploitation likely requires many attempts to win the race.