AI analysis
CVE-2026-95943 is a double-free vulnerability (CWE-415) in Microsoft's Connected Devices Platform Service (Cdpsvc). An authorized local attacker can trigger the flaw to elevate privileges; the CVSS 3.1 score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so complexity is high, no user interaction is required, and the impact on confidentiality, integrity, and availability is high. Microsoft assigned the CVE, and it is associated with the October 2026 Patch Tuesday updates. It affects Windows systems that run the vulnerable Cdpsvc component; specific version ranges were not provided in the source data. There is no known public proof of concept, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Install Microsoft's October 2026 Patch Tuesday updates that address CVE-2026-95943. Prioritize shared or multi-user Windows systems where a local low-privilege account could attempt elevation. No public exploit is known and the issue is not on the CISA KEV list, but patching is the concrete fix because the flaw is local and needs no user interaction once an attacker has a low-privilege foothold.
Affected
| Microsoft Connected Devices Platform Service (Cdpsvc) | — |
Estimated exposure
massHundreds of millions of Windows endpoints (order-of-magnitude estimate) — Cdpsvc is a built-in service on modern Windows client systems, and public estimates put active Windows installations in the hundreds of millions to over a billion; the exact vulnerable build range is not in the source data, so this is an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.