{"id":"CVE-2026-119874","kind":"vulnerability","aliases":["CVE-2026-119874"],"related":[],"title":"Windows: use-after-free in Device Association Service allows local privilege escalation","description":"Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"A memory-handling bug in the Windows Device Association Service lets a user who already has local access gain higher privileges. The sources describe a local elevation of privilege and give no details beyond that.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Device Association Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:38+00:00","updated_at":"2026-11-10T19:51:38+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: use-after-free in Device Association Service allows local privilege escalation","impact":"high","summary":"A memory-handling bug in the Windows Device Association Service lets a user who already has local access gain higher privileges. The sources describe a local elevation of privilege and give no details beyond that.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains elevated system privileges on the Windows machine.","analyst_note":"Confirm affected Windows builds and whether a Microsoft security update fixes it; check the MSRC advisory for CVE-2026-119874.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Device Association Service","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines running the Device Association Service, where an authorized local user could elevate privileges. The sources do not say which Windows versions are affected or whether the service is enabled by default.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4480,"output_tokens":432,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and whether a Microsoft security update fixes it; check the MSRC advisory for CVE-2026-119874.","search":"'-119874':16A,19A '-2026':15A,18A 'access':44B 'allow':10A,69C 'alreadi':41B 'associ':8A,35B,67C 'association':22A 'attack':72C 'author':71C 'beyond':60B 'bug':30B 'cve':14A,17A 'describ':50B 'detail':59B 'devic':7A,34B,66C 'device':21A 'elev':53B,74C 'escal':13A 'free':5A,63C 'gain':45B 'give':57B 'handl':29B 'higher':46B 'infrastructur':24B 'let':37B 'local':11A,43B,52B,76C 'memori':28B 'memory-handl':27B 'privileg':12A,47B,55B,75C 'servic':9A,36B,68C 'service':23A 'sourc':49B 'use':3A,61C 'use-after-fre':2A 'user':39B 'window':1A,25B,33B,65C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the Device Association Service, where an authorized local user could elevate privileges. The sources do not say which Windows versions are affected or whether the service is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["deviceassociationservice","windowsdeviceassociationservice"],"ptokens":["association","device","service","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-119874':16A,19A '-2026':15A,18A 'allow':10A 'associ':8A 'association':22A 'cve':14A,17A 'devic':7A 'device':21A 'escal':13A 'free':5A 'local':11A 'privileg':12A 'servic':9A 'service':23A 'use':3A 'use-after-fre':2A 'window':1A 'windows':20A","search_b":"'access':44B 'alreadi':41B 'associ':35B 'beyond':60B 'bug':30B 'describ':50B 'detail':59B 'devic':34B 'elev':53B 'gain':45B 'give':57B 'handl':29B 'higher':46B 'infrastructur':24B 'let':37B 'local':43B,52B 'memori':28B 'memory-handl':27B 'privileg':47B,55B 'servic':36B 'sourc':49B 'user':39B 'window':25B,33B","search_c":"'allow':69C 'associ':67C 'attack':72C 'author':71C 'devic':66C 'elev':74C 'free':63C 'local':76C 'privileg':75C 'servic':68C 'use':61C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119874","severity":null,"published_at":"2026-11-10T19:20:06+00:00","modified_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}