Windows Cdpsvc EUVD-2026-99385

Exploitation requires the attacker to already possess local, low-privileged execution on the target host (CVSS PR:L, AV:L) - there is no remote or unauthenticated path. The specific prerequisite is the ability to interact locally with the Connected Devices Platform Service (Cdpsvc), which runs by default on supported Windows client and server editions. Key limiting factors: high attack complexity (AC:H) because triggering the use-after-free depends on winning a memory-reclamation race window, meaning exploitation is not reliably repeatable; no user interaction is needed (UI:N) but a prior foothold is mandatory. Patched builds listed in EUVD (e.g., Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761) are not affected.

This is a moderate-priority local privilege escalation (CWE-416 use-after-free) in the Windows Connected Devices Platform Service (Cdpsvc), rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). All real-world exploitation signals point AWAY from urgent, widespread risk despite the high technical impact: the CVSS vector requires local access (AV:L), high attack complexity (AC:H, consistent with the race-condition timing typical of use-after-free bugs), and existing low privileges (PR:L) - so an attacker must already have a foothold on the host. CISA's SSVC framework corroborates this, reporting Exploitation: none and Automatable: no, with Technical Impact: total (reflecting the C:H/I:H/A:H full compromise once triggered). No EPSS score was provided in the input, and there is no KEV listing and no public POC, so the signals are internally consistent rather than conflicting: a genuinely high-impact-but-low-immediate-likelihood issue. Note the 'Denial Of Service' tag in the input conflicts with the description, which describes only privilege elevation, not availability loss as the primary outcome - verify intended impact with the vendor; the A:H in the CVSS vector is consistent with the memory-corruption nature of a UAF. This should be patched on a normal cadence as part of defense-in-depth against post-compromise escalation, not treated as an emergency.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing or a standard user account) runs a crafted program that interacts with the Connected Devices Platform Service to trigger a use-after-free, winning a timing race to reclaim the freed object and corrupt memory. Successful exploitation elevates the attacker to higher (likely SYSTEM) privileges for full host compromise. No public exploit identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.