EUVD-2026-99468
GHSA-2jg2-9j87-cwj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to local Windows session
-
ExploitInvoke crafted request to Device Association Service
-
ExecutionTrigger out-of-bounds read (CWE-125)
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local, interactive or authenticated low-privileged session on the affected Windows host (PR:L, AV:L) - the attacker must already be able to execute code locally to interact with the Device Association Service. There is no remote attack surface and no user interaction by a victim is needed (UI:N). Exploitation is limited to memory disclosure (C:H, I:N, A:N) and, per CISA SSVC, is not automatable and only partially impactful, so it cannot be mass-exploited; realistic use is as a secondary step (e.g., ASLR bypass) by an attacker who already has a foothold. The service is present by default across all supported Windows editions, so no non-default configuration is required. |
| Impact | This is a moderate-severity, low-priority issue despite being a Windows flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) confirms local-only attack vector requiring an already-authenticated low-privileged account, with impact limited to confidentiality (information disclosure) and no integrity or availability impact. All exploitation signals point low: it is NOT in CISA KEV, no public POC is referenced, and CISA SSVC scores it Exploitation=none, Automatable=no, Technical Impact=partial - consistent with the single-system, non-automatable, info-leak nature of an out-of-bounds read (CWE-125). There is no conflict between the signals; the low EPSS-type indicators, absent exploitation, and local-auth requirement all agree this is a defense-in-depth patch rather than an emergency. The main caveat is that the only references are the MSRC update-guide and NVD/EUVD stub pages, so no independent technical detail beyond Microsoft's one-line description is available. |
| Exploit ScenarioDerived | A local attacker who already has a low-privileged authenticated session on a Windows host runs a crafted program that interacts with the Device Association Service, triggering an out-of-bounds read that returns adjacent process/kernel memory. The disclosed memory could leak sensitive data such as pointers or secrets useful for defeating ASLR or chaining with another vulnerability. No public exploit is identified and the attack cannot be performed remotely or without valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.
RemediationAI
Vendor-released patch is available: apply the current Microsoft cumulative update for your Windows build so the host reaches or exceeds the fixed levels in the affected-version table - 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2) and 10.0.26100.33650 (Server 2025), 10.0.26200.9711 (Windows 11 25H2), 10.0.26300.9711 (Windows 11 26H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.20348.5761 (Server 2022), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2); follow the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85336 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-85336. Standard Windows servicing guidance applies - install the monthly rollup/Latest Cumulative Update, reboot to complete the service binary replacement, and audit for pending-reboot hosts, since the vulnerable DAS binary continues to run until restart. Because exploitation requires an existing low-privileged local session, the compensating control with the best risk/benefit ratio is limiting and auditing interactive and remote-desktop logon rights on sensitive hosts so untrusted users never obtain the local execution the flaw needs; this changes no service behaviour and is the recommended stopgap only where patching must be deferred. Disabling the Device Association Service outright (sc stop DeviceAssociationService / set startup to Disabled) removes the attack surface but breaks Bluetooth, wireless display/Miracast and other device-pairing and association functionality and can degrade plug-and-play device setup, so it should be limited to hardened, non-workstation roles where pairing is not required. Running DAS with the least accessible identity is not an option - it is a fixed SYSTEM service - and network segmentation, WAF or endpoint filtering do not mitigate this issue because the vector is strictly local (AV:L) with no remote component; prioritise patching over architectural workarounds. No public exploit code was identified at time of analysis and CISA SSVC marks exploitation as 'none' and non-automatable, so this can be scheduled within the normal monthly patch cycle rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-125 (Out-of-bounds read) affects the Windows Device Association Service, the SYSTEM-level service that brokers device pairing and association operations (Bluetooth, wireless display/Miracast, and other device-association APIs) on behalf of user-mode callers. The tag 'Buffer Overflow' plus the C:H/I:N/A:N profile indicates the defect is a missing or incorrect length/bounds validation on an attacker-influenced input path: a caller with a local session supplies data that causes the service to read beyond the end of a heap or stack buffer and return the over-read bytes in its response, leaking process or kernel-adjacent memory to the caller. Because impact is confined to confidentiality with no integrity or availability effect, the practical significance is the information leaked (pointers, tokens, layout data) rather than service disruption. Exploitation prerequisites are strictly local - AV:L with PR:L means an existing low-privileged local session, and UI:N means no user prompt or victim interaction is needed; the service is not exposed remotely and requires no non-default configuration, so reachability is universal on the affected builds. Per the SSVC inputs (Exploitation: none, Automatable: no, Technical Impact: partial), the issue is not mass-exploitable and does not merit emergency handling.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only service interaction requires an authenticated low-privileged account (AV:L, PR:L); impact is pure memory disclosure so C:H with I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB