CVE-2026-85332
7.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416
Impact
A local attacker with an existing account can elevate privileges to SYSTEM. They need prior code execution or shell access on the host first.
Root cause
A use-after-free flaw in the Windows Device Association Service allows unauthorized local privilege escalation.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the vendor security update from the MSRC advisory for Windows Device Association Service; no interim workaround is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.