---
id: "CVE-2026-119844"
page: "https://infrastack.ai/live/CVE-2026-119844"
kind: "vulnerability"
aliases: ["CVE-2026-119844"]
title: "Windows Device Association Service: use-after-free lets local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Device Association Service", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local-privilege-escalation", "windows", "windows-11", "windows-server-2025"]
not_affected_if: []
published_at: "2026-11-10T19:20:01+00:00"
first_seen_at: "2026-11-10T19:24:59+00:00"
updated_at: "2026-11-10T22:48:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119844", "first_seen_at": "2026-11-10T19:24:59+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-119844", "first_seen_at": "2026-11-10T22:48:08+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-119844", "https://app.opencve.io/cve/CVE-2026-119844"]}]
exploit_sources: []
---

# Windows Device Association Service: use-after-free lets local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-119844 (this .md is for agents)

Use-after-free (CWE-416) in the Windows Device Association Service lets a local user with low privileges elevate to higher privileges. Microsoft rates it CVSS 7.0 (local, high complexity, low privileges). Fixed in the 10 Nov 2026 updates. Not known to be exploited and no public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Device Association Service affected range not listed fixed no fixed version listed
- vendor:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion and compare the full build number (10.0.<build>.<revision>) with the fixed builds: Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2025 10.0.26100.33822. Anything lower is affected. Whether the service runs by default is not stated by the sources I could read.

## Fix

Install the November 2026 Windows cumulative update: Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2025 10.0.26100.33822.

## Timeline

- 2026-11-10T19:24:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119844
- 2026-11-10T22:48:08+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-119844 — MSRC page is JS-only (empty text), so nothing verified. Affected builds and fixed builds come from Microsoft's CNA data as shown by NVD and OpenCVE. No exploitation or PoC found; KEV false. Whether the service runs by default is unknown.

## Documents

- [describes] NVD CVE-2026-119844 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-119844
- [mentions] OpenCVE CVE-2026-119844 affected builds https://app.opencve.io/cve/CVE-2026-119844

## From the sources

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_