CVE-2026-85336 in Windows
Summary
by MITRE • 10/14/2026
Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as an out-of-bounds read within the Windows Device Association Service represents a critical memory safety flaw that compromises the integrity of system data through unauthorized disclosure. This specific service is responsible for managing associations between devices and user accounts, facilitating seamless connectivity experiences such as phone linking or peripheral integration. When processing input related to device identifiers or association metadata, the application fails to perform adequate bounds checking on array indices or buffer lengths before accessing memory locations. Consequently, if an attacker provides crafted data that exceeds expected limits but remains within accessible virtual address space, the service reads beyond the allocated buffer boundaries. This behavior aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software accesses memory outside of intended bounds without writing to it, potentially leading to information disclosure rather than code execution or denial of service in this specific context.
The operational impact of this flaw centers on local privilege escalation through information leakage. Because the vulnerability requires an authorized attacker, it typically implies that a user with valid credentials must first execute malicious code or interact with the compromised component. Once triggered, the out-of-bounds read allows the attacker to retrieve sensitive data stored in adjacent memory regions. This disclosed information may include cryptographic keys, session tokens, personal identification details associated with linked devices, or other proprietary system states. The ability to exfiltrate such data locally can serve as a stepping stone for further exploitation, enabling attackers to bypass authentication mechanisms or impersonate legitimate users within the Windows ecosystem. From an adversary perspective, this activity maps closely to ATT&CK technique T1005, which describes Data from Local System Retrieval, specifically under sub-techniques involving memory scraping or direct access to local data stores without triggering standard alerting systems designed for network-based exfiltration.
Mitigation strategies must address both the immediate technical flaw and broader security posture improvements. Microsoft has released patches that correct the boundary validation logic within the Device Association Service codebase, ensuring that all array accesses are strictly validated against allocated buffer sizes before execution proceeds. Administrators should prioritize applying these updates to affected Windows versions to eliminate the root cause of the vulnerability. In addition to patching, organizations should enforce strict application whitelisting and least-privilege principles to limit the ability of unauthorized processes or compromised user accounts to interact with system services. Monitoring for anomalous memory access patterns using endpoint detection and response tools can also help identify potential exploitation attempts in real-time. Furthermore, disabling unnecessary device association features if they are not required by business operations reduces the attack surface available to local attackers seeking to leverage this flaw for information disclosure.