AI analysis
CVE-2026-83846 is a use-after-free flaw (CWE-416) in Microsoft’s Connected Devices Platform Service (Cdpsvc). A locally authorized attacker who already has low privileges can trigger the bug, with no user interaction, to elevate privileges on the same machine; attack complexity is rated high. Successful exploitation has high impact on confidentiality, integrity, and availability inside the local security boundary (CVSS 3.1 base score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue was assigned by Microsoft and is associated with the October 2026 Patch Tuesday updates; exact affected build numbers were not included in the source data. No public proof-of-concept is known and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Install Microsoft’s October 2026 security updates on Windows systems that include Connected Devices Platform Service, then confirm the patched build is in place. No workaround is described in the source data; until patched, limit which local accounts can run code. There is no known public exploit or CISA KEV listing.
Affected
| Microsoft Connected Devices Platform Service (Cdpsvc) | — |
Estimated exposure
masshundreds of millions of Windows installations (order-of-magnitude estimate) — Cdpsvc is a built-in Windows service on modern client releases, and the global Windows install base is on the order of a billion devices, so unpatched systems before the October 2026 updates are plausibly in the hundreds of millions; this…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.