Windows Device Association Service: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability in the Windows Device Association Service allows an authorized local attacker to elevate privileges. The CNA record rates it CVSS 7.0 (High) and classifies it as CWE-416 and CWE-822. An attacker needs a low-privileged account on the system and must meet a high-complexity condition, so an initial foothold is required first. CISA SSVC lists no known exploitation and no automatable exploitation.

Affected

• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974 (unverified, from secondary source)
• Windows 11 Version 25H2: builds before 10.0.26200.9974 (unverified, from secondary source)
• Windows 11 Version 26H1: builds before 10.0.28000.3501 (unverified, from secondary source)
• Windows 11 Version 26H2: builds before 10.0.26300.9974 (unverified, from secondary source)
• Windows Server 2022: builds before 10.0.20348.5870 (unverified, from secondary source)
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33822 (unverified, from secondary source)
• Windows Server 2016 and 2019: unknown

Fixed in

• Install the November 2026 cumulative updates for the affected Windows versions, which provide the builds listed above or later.
• Confirm the exact fixed builds and KB numbers in the MSRC advisory, as the research data could not verify them.

Workaround

Unknown. No vendor mitigation is documented; patching is the only confirmed fix.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof-of-concept found.
• No EPSS score available.
• The CVE record uses exploit maturity Unproven (E:U).
• The Device Association Service has had several other 2026 privilege escalation CVEs.

Our recommendation

• Patch all affected Windows 10 and 11 clients and Windows Server systems with the November 2026 cumulative updates, prioritising systems with many users.
• Verify the fixed build numbers in the MSRC advisory before rollout.
• Check whether Windows 10 21H2 and 22H2 systems have Extended Security Updates (ESU) coverage, as they may need it to receive the fix.
• Reduce the risk of a foothold by limiting local logons and administrator rights and keeping email and browser protection current.
• Monitor for unusual privilege changes on endpoints until patching is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119866 msrc.microsoft.com
• CVE Record CVE-2026-119866 (CNA: Microsoft) www.cve.org
• Strix CVE-2026-119866 (secondary source, unverified versions) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:36.