CVE-2026-83940

CVE-2026-83940 is a use-after-free memory corruption flaw (CWE-416) in the Windows Device Association Service, a built-in Windows component that handles pairing and association of devices. An authorized attacker with existing low-privilege access on the local machine can trigger the flaw by inducing the service to free an object in memory and then access it again, though the high attack complexity suggests specific timing or conditions are required. Successful exploitation allows the attacker to elevate privileges locally, gaining higher rights on the affected system (high confidentiality, integrity, and availability impact). Any Windows installation running the Device Association Service is affected; the source data does not enumerate specific Windows version ranges. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Apply the Windows security update for CVE-2026-83940 released by Microsoft as soon as it is available for your Windows versions, and verify patch status via your endpoint management or vulnerability scanner. Because exploitation requires local access, prioritize patching shared workstations, RDP/VDI hosts, and systems that untrusted or low-privilege users can access. Until patched, restrict local logon rights on sensitive systems and monitor Microsoft's advisory for updated affected-version details.