Windows Device Association Service: Local privilege escalation

Summary

Microsoft has published a fix for a local privilege escalation vulnerability in the Windows Device Association Service, caused by an untrusted pointer dereference (CWE-822). An attacker with local access and a low-privileged account can gain higher privileges without user interaction, which gives full control over confidentiality, integrity and availability. It is a step after an initial foothold, not an internet-facing entry point. NVD analysis was still pending at the time of publication.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2: before 10.0.26200.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows 11 Version 26H2: before 10.0.26300.9974
• Windows Server 2022: before 10.0.20348.5870

Fixed in

• Install the November 2026 Windows security updates, which contain the fixed builds listed above.
• Confirm the exact build and KB number for each edition in the MSRC advisory before rollout.

Workaround

Unknown. No workaround or mitigation is documented in the sources.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• The CVSS vector marks exploit code maturity as Unproven.
• No public proof of concept or exploitation report was found at the time of research.

Our recommendation

• Deploy the November 2026 cumulative updates, starting with shared workstations, terminal servers and other multi-user systems.
• Confirm that Windows 10 1607, 1809 and 21H2 devices are enrolled in Extended Security Updates, as these builds are out of mainstream support.
• Limit unnecessary local logons and restrict local administrator rights to reduce the risk of escalation.
• Monitor for repeated crashes or restarts of the DeviceAssociation service.
• Recheck NVD and the CISA KEV catalogue in the coming days, as analysis was still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-112743 msrc.microsoft.com
• CVE Record: CVE-2026-112743 www.cve.org
• Windows Forum: DeviceAssociation service local privilege escalation windowsforum.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:23.