Windows Device Association EUVD-2026-99472

Exploitation requires the attacker to already have authenticated local access with low privileges (PR:L) on the Windows host - this is a post-foothold privilege-escalation primitive, not a remote entry point. The attacker must interact with the Windows Device Association Service (the DeviceAssociationService, which handles pairing/association of devices such as Bluetooth and networked peripherals), meaning the service must be present and reachable in the running configuration (it is a default Windows component). The key limiting factor is the high attack complexity (AC:H): the use-after-free is a race condition the attacker must win through precise timing, so exploitation is non-deterministic and typically needs repeated attempts, which is why CISA SSVC rates it non-automatable. No user interaction is required (UI:N).

Signals align toward a moderate, non-urgent priority. CVSS 3.1 base is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N - local attack vector requiring low-privilege authorization and, critically, high attack complexity, which reflects the race-condition nature typical of use-after-free flaws (CWE-416). CISA SSVC reinforces a lower real-world urgency: Exploitation='none' (no observed exploitation), Automatable='no' (cannot be reliably mass-exploited, consistent with AC:H), while Technical Impact='total' (full compromise of the affected component, matching C:H/I:H/A:H). There is no CISA KEV listing and no public POC in the provided data, so this is NOT actively exploited. EPSS was not provided and cannot be cited. Net: a genuine local elevation-of-privilege bug worth patching in normal cycles, but the AC:H race condition plus 'not automatable' SSVC rating make it a lower practical risk than a network-facing or unauthenticated flaw. This is closer to a 'high-CVSS-but-constrained-real-risk' issue for most environments, though it is valuable as a post-compromise escalation primitive on the ubiquitous Windows platform.

A local, low-privileged attacker who already has code execution on a Windows host (e.g., via phishing or a standard user account) triggers a use-after-free race condition in the Device Association Service to corrupt memory and execute code with elevated (SYSTEM-level) privileges. No user interaction is required, but the high attack complexity means the attacker must win a timing race, likely requiring multiple attempts. No public exploit code is identified at time of analysis.