A use‑after‑free flaw in Windows Device Association Service allows an authorized local attacker to elevate privileges. The vulnerability is a classic use‑after‑free condition, enumerated as CWE‑416, which can grant the attacker higher privileges on the affected system. The CVSS score of 7 indicates moderate to high severity, meaning exploitation could result in full control for a privileged user, potentially compromising data integrity and confidentiality.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server editions 2012 R2, 2016, 2019, 2022 and 2025. Both standard and Server Core installations are impacted.

The CVSS score indicates significant risk, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. The attack vector is local; an attacker with authorized credentials is required to trigger the use‑after‑free, meaning the high local privilege escalation potential depends on being able to run code on the machine.