CVE-2026-69516 — Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Executive Summary

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Overview

7

CVSS HIGH

Important

MS Severity

Not Exploited

MS Exploit Status

Exploitation Unlikely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-416: Use After Free

Released Sep 8 2026

Last Updated Sep 8 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

CVSS Vector

ATTACK VECTOR

Local

ATTACK COMPLEXITY

High

PRIVILEGES REQUIRED

Low

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 6.1

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

22 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1809 for 32-bit Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for x64-based Systems	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for x64-based Systems	`5122878 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for x64-based Systems	`5122880 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for x64-based Systems	`5124008 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 version 26H1 for x64-based Systems	`5124012 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019 (Server Core installation)	`5122876 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022 (Server Core installation)	`5122882 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025 (Server Core installation)	`5122871 (Security Update)`	Important	Elevation of Privilege	Yes

Patches

7 patches

Article	Type	Restart
`5122876`	Security Update	Yes
`5122878`	Security Update	Yes
`5122880`	Security Update	Yes
`5124008`	Security Update	Yes
`5124012`	Security Update	Yes
`5122882`	Security Update	Yes
`5122871`	Security Update	Yes

Patch Diff

ghidriff · cdpsvc.dll (KB5124008)

Use-after-free (CWE-416) in the Connected Devices Platform Service (cdpsvc.dll) SharingPlatform session code, local elevation of privilege from Medium Integrity to Local Service via a race condition (Important, EoP, AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, CVSS 7.0; Exploitation Unlikely). The SharingPlatform session functions (SessionClient::CreateAndStartSessionStream, SessionHost::CreateAndStartSessionStream, Internal::SessionDiscoveryAsyncOperation::OnConnectedInternal, SendInvitationHelper::SendInvitationToDevice, and the CDPListener creation path) obtained the process-wide 'sessions AppId' COM object from a global static (_sm_spSessionsAppId). PRE: the code read that global directly - null-checked it, AddRef'd it (vtable+8) and used the raw pointer (e.g. local = _sm_spSessionsAppId) with no synchronization against concurrent release/replacement of the static, so a second thread that releases or re-initializes the global between the check and the use frees the object while this path still references it - a use-after-free in the Local Service cdpsvc process, reachable by a Medium-IL caller that wins the race. Diff of cdpsvc.dll 10.0.26100.9278 -> .9444 (Sep 8 2026, KB5124008, 24H2/25H2) confirms the fix: the direct global-static access is replaced across these functions by a call to a NEW accessor SharingPlatform::SharingPlatformStatics::GetSessionsAppId(&local), which returns a properly reference-counted local ComPtr (and returns/logs an error via wil ..\sessionclient.cpp:0x148 on failure) instead of handing out the raw shared pointer - so the AppId object can no longer be freed out from under the session path. The change is unconditional (not CFR-gated). Provenance note: this Sep-2026 cdpsvc build also carries extensive unrelated WIL feature-reporting/telemetry churn (wil::details::EnabledStateManager, FeatureImpl<__WilFeatureTraits_Feature_4001340728>, WilApi_RecordFeatureUsage, ReportUsageToService, etc.); those are library re-emission, not this fix. The security-relevant change is the _sm_spSessionsAppId -> GetSessionsAppId lifetime refactor. (This is the corrected diff of the 24H2 .9278->.9444 pair; an earlier attempt failed with a ghidriff symbol-count assertion because one build was unsymbolized.)

Pre-patch version 10.0.26100.9278 Download

Post-patch version 10.0.26100.9444 Download

Function	Address	Change	Note
`SharingPlatform::SessionClient::CreateAndStartSessionStream`	`code change`	code (replaces racy global-static AppId use with a ref-counted accessor)	Pre: if (_sm_spSessionsAppId != 0) { (*(vtbl+8))(); } local = _sm_spSessionsAppId; - AddRef+use of the raw global static, no sync vs concurrent release. Post: lVar2 = SharingPlatformStatics::GetSessionsAppId(&local_78); if (lVar2 < 0) Return_Hr(...,0x148,".\\sessionclient.cpp",...) else use local_78 - a properly reference-counted local copy. (~82% match; the most-changed session function.)
`SharingPlatform::SessionHost::CreateAndStartSessionStream`	`code change`	code (same AppId-lifetime refactor)	Same replacement of direct _sm_spSessionsAppId use with GetSessionsAppId on the session-host stream-creation path.
`SharingPlatform::Internal::SessionDiscoveryAsyncOperation::OnConnectedInternal`	`code change`	code (same AppId-lifetime refactor, async path)	Async connect-completion path; now takes a referenced AppId via GetSessionsAppId rather than the global static, closing the race in the asynchronous callback.
`SharingPlatform::SendInvitationHelper::SendInvitationToDevice`	`code change`	code (same AppId-lifetime refactor)	Invitation path; same GetSessionsAppId accessor substitution.
`SharingPlatform::SharingPlatformStatics::GetSessionsAppId`	`new/accessor`	added (safe reference-counted accessor)	New accessor that returns an AddRef'd local ComPtr to the sessions AppId under the statics' own synchronization, replacing every direct read of the _sm_spSessionsAppId global. Added to the callees of the session functions in the diff.

View full diff report View RCA report

Attack Path

A Medium-IL caller races the process-wide sessions-AppId global while cdpsvc creates a session, freeing the object mid-use

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

k0shl
Anonymous

References

MSRC Advisory MITRE NVD