CVE-2025-55677
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An untrusted pointer dereference in the Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. The flaw occurs while the service processes input data.
Risk Assessment
An attacker with limited privileges can exploit the vulnerability to gain higher privileges on the system, potentially leading to full host compromise.
Recommendation
Apply the Microsoft Windows security updates that address this vulnerability.
Other vulnerabilities in Windows Device Association Broker
See all- CVE-2026-69693High
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
- CVE-2025-50174High
A use-after-free vulnerability exists in the Windows Device Association Broker service. It allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS