Device Association Service EUVD-2026-99479

Requires the attacker to already have local, authenticated low-privileged code execution on the target host (PR:L, AV:L) - there is no remote or network-reachable path. Exploitation specifically targets the Windows Device Association Service, and the HIGH attack complexity (AC:H) reflects a timing-dependent race condition inherent to the use-after-free, which limits reliability and means exploitation is not automatable (per CISA SSVC Automatable: no). No user interaction is needed (UI:N). The practical limiting factors are the need for a prior foothold and the difficulty of reliably winning the memory-reuse race; the main at-risk deployments are multi-user, shared, or terminal-server Windows systems where untrusted local users operate.

This is a moderate-priority local privilege escalation rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) tells a consistent story with the description: the attacker must already be a local, low-privileged authenticated user, and exploitation carries HIGH attack complexity (AC:H) - characteristic of the race-condition timing window typical of use-after-free (CWE-416) bugs. All three exploitation signals point toward low real-world urgency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public POC was provided, so this is 'no public exploit identified at time of analysis.' The one signal arguing for attention is SSVC Technical Impact 'total' (mirrored by C:H/I:H/A:H), meaning successful exploitation yields full SYSTEM compromise. The signals are internally consistent - there is no conflict between CVSS, SSVC, and the description. Net assessment: a real but not top-tier priority; it is a valuable post-compromise escalation primitive for an attacker who already has a foothold, not a remotely-reachable or wormable issue. Patch promptly in normal cycles, prioritizing multi-user and shared/kiosk Windows hosts where untrusted local users exist.

A low-privileged authenticated user who has already gained a foothold on a Windows host (via phishing, a prior exploit, or a shared/terminal-server login) runs a crafted program that manipulates the Device Association Service to trigger a use-after-free. By winning the race condition and controlling the freed-then-reused memory, the attacker corrupts memory to execute code in the service's context, escalating to SYSTEM. No public exploit code was provided at time of analysis, and the HIGH attack complexity (AC:H) means reliable exploitation requires winning a timing-sensitive race.