Device Association Service EUVD-2026-99469

Exploitation requires local access to the affected Windows host with at least low-privilege authenticated user rights (PR:L), and the ability to execute code that interacts with the Device Association Service (the component hosting the use-after-free). No user interaction by a victim is needed (UI:N), and no special non-default feature toggle is indicated by the description - the Device Association Service is a standard Windows component. Limiting factors: the attack vector is strictly local (AV:L), so there is no remote or network-facing exposure, and the attacker must already have a valid foothold/session on the machine; this is a post-access privilege-escalation primitive, not an entry point. Affected builds per EUVD span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025, each fixed in the listed cumulative update build.

This is a genuine but second-tier patching priority - a classic local elevation-of-privilege (EoP) flaw rather than a remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local, authenticated, low-privilege access, which caps the base score at 7.8 (High) despite full C:H/I:H/A:H impact. Multiple signals agree on reduced urgency: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' (consistent with a local vuln that cannot be scripted for mass remote spraying), even though it rates Technical Impact as 'total.' There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked against FIRST's EPSS feed before final prioritization. The signals are internally consistent (local vector + SSVC Automatable:no + no KEV + no POC all point the same way), so this is a 'high-CVSS, moderate-real-risk' issue: it matters for defense-in-depth and post-compromise hardening, but it is not a drop-everything remote threat.

An attacker who has already gained a foothold on a Windows host as a standard (low-privileged) user runs a crafted local program that triggers a use-after-free in the Device Association Service, corrupting memory to hijack execution in a higher-privileged context and gain SYSTEM-level control. No public exploit code is referenced in the available data, and exploitation requires local code execution, so this is most plausible as the second stage of an intrusion (after phishing, a web-app foothold, or stolen credentials) rather than an initial access vector.