CVE-2025-55677 — Windows Device Association Broker Service Elevation of Privilege Vulnerability
Executive Summary
Untrusted pointer dereference in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 11 Version 24H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5066835 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5066835 |
Security Update | Yes |
Patch Diff
Untrusted pointer dereference (CWE-822) in the Windows Device Association Broker service das.dll, local elevation of privilege from Medium Integrity to Local Service (Important, AV:L, AC:L, CVSS 7.8). das.dll brokers device association and stores per-device properties read/written via _PnpGetObjectProperty / _PnpSetObjectProperty, which route property data through _PnpValidatePropertyData (property data is typed - e.g. security-descriptor strings via ConvertStringSecurityDescriptorToSecurityDescriptorW). PRE: device-property data was interpreted without fully validating its type/size against the supplied buffer, so a property whose declared type implies an embedded pointer/typed reference could cause the service to dereference an attacker-controlled (untrusted) pointer; no race is required (AC:L). Self-diff (ghidriff, --no-bsim) of das.dll 10.0.26100.5074 -> .6725 (Oct 14 2025, KB5066835; das file version .6725 ships in KB5066835 whose OS build is .6899) confirms the fix: _PnpValidatePropertyData (called by _PnpGetObjectProperty, _PnpSetObjectProperty, ValidFilter, ValidateQueryData) gains validation (body 889 -> 957 bytes, ratio 0.25) gated behind CFR flag Feature_KernelPnP_PropertyValidation, validating the property type/size against the buffer before the data is interpreted. This same consolidated validation also fixes the companion use-after-free CVE-2025-50174; the two bugs are not separately isolable in the binary (confirmed-changed level).
| Function | Address | Change | Note |
|---|---|---|---|
_PnpValidatePropertyData |
code change |
code (device-property data validation added, CFR-gated) | Body grew 889 -> 957 bytes (ratio 0.25); now calls Feature_KernelPnP_PropertyValidation and validates property type/size against the supplied buffer before use, so a property whose type implies an embedded pointer can no longer drive an untrusted pointer dereference. Called by _PnpGetObjectProperty / _PnpSetObjectProperty / ValidFilter / ValidateQueryData. |
Feature_KernelPnP_PropertyValidation |
gate |
added (CFR gate) | New CFR flag gating the property-data validation in _PnpValidatePropertyData; the original unvalidated interpretation still ships when disabled. (The remainder of the diff is WIL feature-flag infrastructure linked in with this gate.) |
Attack Path
Crafted device-property data drives the broker to dereference an untrusted pointer
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.
Exploits & PoC
Detection Rules
Acknowledgments
Hwiwon Lee (hwiwonl), SEC-agent team
Jongseong Kim (nevul37), SEC-agent team