CVE-2026-95943

HighCVSS 7.0

Published: 13/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

A double free vulnerability in Connected Devices Platform Service (Cdpsvc) allows an authenticated attacker to elevate privileges locally. The flaw arises from double freeing of memory.

Risk Assessment

An authenticated attacker could exploit this flaw to escalate privileges, potentially resulting in takeover of the service and system.

Recommendation

Immediately install the security updates for Connected Devices Platform Service provided by Microsoft.

Other vulnerabilities in Connected Devices Platform Service (Cdpsvc)

CVE-2026-20864High
Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Original NVD description (English source)

Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS