Windows Device Association EUVD-2026-99525

Exploitation requires authenticated, low-privileged LOCAL access to the target Windows system (CVSS AV:L, PR:L) - there is no network-facing or remote vector and no user interaction is needed (UI:N). The specific prerequisite is the ability to interact locally with the Windows Device Association Service (the component that manages pairing/association of devices), which is present by default across all supported Windows 10/11 client builds and Windows Server 2012 through 2025 editions (including Server Core) per the EUVD affected-version list. Limiting factors that reduce real-world risk: the attacker must already have a local account/session on the host, the impact is confined to information disclosure (C:H only; no integrity or availability impact and scope unchanged, S:U), and CISA SSVC rates the issue as not automatable, meaning it cannot be mass-exploited remotely. No non-default configuration is required.

This is a genuinely moderate-priority, low-urgency issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable, low-privilege flaw in the Windows Device Association Service that yields high confidentiality impact but no integrity or availability impact - an information-disclosure-only out-of-bounds read (CWE-125). The CISA SSVC decision framework reinforces a low-priority verdict: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local-only vector that cannot be mass-scanned/wormed), and Technical Impact=partial (consistent with read-only disclosure, not full compromise). There is no CISA KEV listing and no public proof-of-concept provided, so this is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so exploitation-probability cannot be quantified here; however, the local attack vector and partial/read-only impact strongly suggest low real-world exploitation likelihood. The one caveat worth stating: C:H on an out-of-bounds read means the disclosed memory could include sensitive material (e.g., addresses useful for defeating ASLR or leaked secrets), so while this is not an urgent internet-facing threat, it is a realistic component of a local post-compromise or privilege-escalation chain and should be patched in normal cycles. Overall: a real but low-urgency, high-CVSS-confidentiality-but-low-real-risk local issue.

An attacker who already has low-privileged, authenticated local access to a Windows host (e.g., a standard user session or a foothold from a prior compromise) interacts with the Device Association Service in a way that triggers the out-of-bounds read, causing the service to disclose adjacent process memory. The leaked memory could contain sensitive data or pointer/address information usable to weaken ASLR and advance a broader local exploitation chain. No public proof-of-concept is identified at time of analysis, and the local-only vector (AV:L) means remote or automated mass exploitation is not feasible.