CVE-2025-50174
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A use-after-free vulnerability exists in the Windows Device Association Broker service. It allows an authorized attacker to elevate privileges locally.
Risk Assessment
The flaw could be exploited by an attacker with local access to gain elevated privileges, increasing the risk of system compromise.
Recommendation
Immediately deploy the Windows security patches released by Microsoft.
Other vulnerabilities in Windows Device Association Broker
See all- CVE-2026-69693High
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
- CVE-2025-55677High
An untrusted pointer dereference in the Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. The flaw occurs while the service processes input data.
Original NVD description (English source)
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS