The reported vulnerability is a use‑after‑free flaw in the Windows Device Association Service. The flaw permits an attacker who already has local authorized access to cause the service to perform an operation with elevated privileges, effectively escalating the attacker’s privileges on the affected system. The weakness corresponds to improper handling of freed memory and can lead to execution of arbitrary code with higher privileges, compromising system integrity and confidentiality.

Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2019 (including Server Core installations), Windows Server 2022, and Windows Server 2025 (including Server Core installations).

The CVSS score of 7.8 indicates a moderate to high severity. The EPSS score is not available, so the current probability of exploitation remains uncertain, but the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local privileged user or an attacker who has gained local authorized access to the system. Exploitation would require triggering the use‑after‑free condition in the Device Association Service, which typically involves interacting with the device pairing or association features of Windows. No public exploit is known at the time of reporting, yet the high severity warrants prompt mitigation.