The Windows Device Association Service contains a use‑after‑free flaw that enables a local attacker who already has authorized access to the system to gain higher privileges. This bug, classified as CWE‑416, allows malicious code execution by exploiting a prematurely freed object reference.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server 2012 R2, 2016, 2019, 2022, and 2025—including both standard and Server Core installations. The vulnerability spans x86, x64, and arm64 architectures as reflected in the CPE entries.

The CVSS score of 7 indicates a high severity vulnerability. EPSS data are not available and the issue is not listed in the CISA KEV catalog, so the exact exploitation probability cannot be quantified. Based on the description, the attack vector is local, requiring the attacker to already be authorized on the affected machine; remote exploitation is not indicated. Organizations should promptly apply the Microsoft update and consider limiting the Device Association Service if a timely patch cannot be deployed.