CVE-2026-69711

CVE-2026-69711 is a use-after-free (CWE-416) memory-corruption flaw in the Windows Device Association Service (the DasHost service included with Windows). A local attacker who is already authorized on the machine can trigger the flaw by interacting with the service in a way that frees an object still in use, causing exploitable memory corruption. Successful exploitation lets the attacker elevate privileges on the local system, with high impact on confidentiality, integrity, and availability on the host. Any Windows installation that ships the Device Association Service is affected, which by default includes modern Windows client and server editions; Microsoft has not published specific affected version ranges in this data. There are currently no reports of in-the-wild exploitation, no known public proof-of-concept, and a low EPSS score of 0.3% over 30 days.

What to do: Apply Microsoft's cumulative monthly security update addressing CVE-2026-69711 via Windows Update as soon as your change window allows; no specific fixed build or workaround is provided in the available data. Because exploitation requires local access with low privileges, prioritize multi-user hosts, jump boxes, VDI images, and shared workstations where local accounts are less trusted. Re-check KEV/EPSS and vendor advisories periodically, as local privilege escalation bugs in default Windows services are often added to exploit chains after patch release.