Use after free in Windows Management Services allows an unauthorized attacker to elevate privileges locally.

Use-after-free (CWE-416, race-triggered) in the Windows Management Service windows.management.service.dll (Modern Deployment / Autopilot, runs as SYSTEM), local elevation of privilege to SYSTEM (Important, AV:L, AC:H race, CVSS 7.4). ModernDeployment::Autopilot::Core::AutopilotSurfaceHubHelper configures device properties via asynchronous operations ConfigurePropertiesAsync / ApplyPropertiesAsync that operate on a com_ptr_t<IDeviceManagementUtilities>. PRE (.5074): the async operation was built with MakeAsyncHelper / MakeOpLambda and the owning com_ptr to IDeviceManagementUtilities was released when the synchronous call returned - before the async continuation finished using it - so a concurrent teardown/completion could free the utilities object while the async operation still referenced it (race UAF). Because the service runs as SYSTEM and the operation is locally reachable, the freed-object reuse is a local EoP to SYSTEM. Diff of windows.management.service.dll 10.0.26100.5074 -> .6584 (Sep 9 2025, KB5065426) confirms the fix: gated behind CFR flag Feature_3628908857, both ConfigurePropertiesAsync and ApplyPropertiesAsync are reworked from MakeAsyncHelper+MakeOpLambda (non-owning; com_ptr destructed at scope exit) to MakeAsyncAction with an owning lambda (lambda_5875ca7f...) that has its own ctor/dtor and holds a strong com_ptr reference to the utilities object for the whole async action, keeping it alive until the operation completes.

A race frees the device-management utilities object while an Autopilot async property operation still uses it

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Taewoo (Tae_ω02)