Windows Device Association Service: Use-after-free leads to local privilege escalation

Summary

A use-after-free vulnerability in the Windows Device Association Service allows an authorized local user to elevate privileges. An attacker who already has a standard user account on the system can gain SYSTEM rights. The attack is not remotely exploitable and requires local access and a high-complexity condition.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.33822
• Note: the affected list in the CVE record is partly unclear; verify the exact product list in the MSRC advisory.

Fixed in

• Install the November 2026 Windows security update for each affected product line (the fixed builds are listed under 'affected' above).
• KB numbers per product line: Unknown.

Workaround

• Unknown. No vendor workaround is published.
• Unofficial, community-suggested measure: disabling the service if no pairing devices are used. This is not an official mitigation and must be tested before use.

Exploitation

• Microsoft rates exploit code maturity as Unproven (E:U).
• Rapid7 rates exploitation as less likely and reports no public disclosure.
• No confirmed in-the-wild exploitation is known. CISA SSVC lists exploitation as none and automatable as no.
• No public proof of concept was found. The CISA KEV catalogue was not checked directly.

Our recommendation

• Apply the November 2026 Windows security update on all affected systems, prioritizing Windows 10 systems, shared PCs, and terminal or RDS servers.
• Check which systems run affected builds using the MSRC advisory before rollout.
• Restrict local logon and limit standard users on shared systems.
• Monitor for unexpected SYSTEM processes and privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119874 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-119874 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix AI: CVE-2026-119874 (third-party) www.strix.ai
• Senserva: KB5132059 (third-party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:35.