CVE-2025-50174 — Windows Device Association Broker Service Elevation of Privilege Vulnerability
Executive Summary
Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 11 Version 24H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5066835 |
Security Update | Yes |
Patch Diff
Use-after-free (CWE-416, race-triggered) in the Windows Device Association Broker service das.dll, local elevation of privilege from Medium Integrity to Local Service (Important, AV:L, AC:H race, CVSS 7.0). das.dll brokers device association and stores per-device properties read/written via _PnpGetObjectProperty / _PnpSetObjectProperty, routing property data through _PnpValidatePropertyData; typed values (e.g. security-descriptor strings via ConvertStringSecurityDescriptorToSecurityDescriptorW, freed via LocalFree) involve allocated buffers. PRE: the property get/set handling did not adequately validate/serialize a property-data buffer/object lifetime against concurrent operations, so a race between property access and teardown could free a buffer while still in use - a use-after-free; winning the race (AC:H) in the higher-privileged broker elevates Medium Integrity to Local Service. Self-diff (ghidriff, --no-bsim) of das.dll 10.0.26100.5074 -> .6725 (Oct 14 2025, KB5066835; das file version .6725 ships in KB5066835 whose OS build is .6899) confirms the fix: _PnpValidatePropertyData (called by _PnpGetObjectProperty / _PnpSetObjectProperty / ValidFilter / ValidateQueryData) is hardened (body 889 -> 957 bytes, ratio 0.25) gated behind CFR flag Feature_KernelPnP_PropertyValidation, validating property data for type/size/buffer consistency before use so the property-data object can no longer be used after being freed on a racing path. This same consolidated validation also fixes the companion untrusted-pointer-dereference CVE-2025-55677; the two bugs are not separately isolable in the binary (confirmed-changed level).
| Function | Address | Change | Note |
|---|---|---|---|
_PnpValidatePropertyData |
code change |
code (device-property data/lifetime validation added, CFR-gated) | Body grew 889 -> 957 bytes (ratio 0.25); now calls Feature_KernelPnP_PropertyValidation and validates property type/size/buffer consistency before use, constraining the property-data buffer (e.g. converted security descriptor freed via LocalFree) so it can no longer be used after free on a racing path. Called by _PnpGetObjectProperty / _PnpSetObjectProperty / ValidFilter / ValidateQueryData. |
Feature_KernelPnP_PropertyValidation |
gate |
added (CFR gate) | New CFR flag gating the property-data validation in _PnpValidatePropertyData; the original handling still ships when disabled. (The remainder of the diff is WIL feature-flag infrastructure linked in with this gate.) |
Attack Path
A race between a device-property operation and buffer teardown frees a property-data object still in use
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.