CVE-2026-95943: Windows Cdpsvc Privilege Escalation Flaw

CVE-2026-95943 Overview

CVE-2026-95943 is a double free vulnerability [CWE-415] in the Windows Connected Devices Platform Service (Cdpsvc). The flaw allows an authorized local attacker to elevate privileges on an affected system. Successful exploitation can yield high impact to confidentiality, integrity, and availability. Microsoft published the advisory on October 13, 2026.

The vulnerability requires local access and low privileges but has high attack complexity, indicating that race-condition timing or specific preconditions must be met. No user interaction is required. No public exploit code or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Local attackers with standard user privileges can trigger a double free in Cdpsvc to gain SYSTEM-level privileges on affected Windows hosts.

Affected Products

Microsoft Windows (Connected Devices Platform Service / Cdpsvc)
Specific build and version coverage listed in the Microsoft Security Update Guide
Refer to the vendor advisory for the full product and build matrix

Discovery Timeline

2026-10-13 - CVE-2026-95943 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-95943

Vulnerability Analysis

The Connected Devices Platform Service (Cdpsvc) brokers device discovery, pairing, and cross-device messaging on Windows. A double free condition occurs when the service releases the same heap allocation twice during object or message lifecycle handling. This corrupts heap metadata and allocator free lists.

An attacker who controls allocation timing can place attacker-controlled data into the freed region before the second free. The resulting heap corruption can be shaped into an arbitrary write primitive, which is then leveraged to hijack control flow or overwrite security-sensitive structures in the service process. Because Cdpsvc runs with elevated privileges, successful exploitation grants the attacker SYSTEM-level access.

Root Cause

The root cause is improper tracking of ownership for a heap object within Cdpsvc [CWE-415]. Two separate code paths release the same pointer without clearing or reference-counting it after the first free(). This is a classic memory management defect that becomes exploitable when adjacent allocations influence allocator internal state.

Attack Vector

Exploitation requires local, authenticated access to the target system. The attacker interacts with the Cdpsvc IPC surface, typically through RPC calls or named pipe endpoints exposed by the Connected Devices Platform. The attacker must win a race or satisfy a specific state transition to trigger the duplicate deallocation.

The high attack complexity reflects this timing dependency. Once triggered, heap grooming primitives available from the local context allow reliable corruption and privilege escalation to NT AUTHORITY\SYSTEM.

No verified public proof-of-concept code is available. See the Microsoft Security Update CVE-2026-95943 advisory for vendor technical details.

Detection Methods for CVE-2026-95943

Indicators of Compromise

Unexpected crashes or restarts of the Cdpsvc service recorded in the System event log
Werfault.exe crash dumps referencing cdp.dll or related Connected Devices Platform modules
Creation of new SYSTEM-level processes spawned from svchost.exe hosting Cdpsvc without legitimate parent activity
Local user accounts invoking Connected Devices Platform RPC interfaces at abnormal frequency

Detection Strategies

Monitor Windows Error Reporting telemetry for repeated faults in the Cdpsvc-hosted svchost.exe instance
Correlate standard-user process activity with subsequent SYSTEM-context process creation on the same host
Baseline normal RPC call volume to Connected Devices Platform endpoints and alert on anomalies

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 10 (process access) targeting svchost.exe instances hosting Cdpsvc
Collect and retain crash dumps from the Connected Devices Platform Service for post-incident analysis
Review authentication logs for local privilege escalation patterns following service instability

How to Mitigate CVE-2026-95943

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows systems
Prioritize patching on multi-user systems, terminal servers, and workstations accessible to lower-trust accounts
Audit local user accounts and remove unnecessary interactive logon rights

Patch Information

Microsoft released a security update addressing CVE-2026-95943 on October 13, 2026. Deploy the fix through Windows Update, Microsoft Update Catalog, or your enterprise patch management workflow. Validate installation by confirming the updated binary versions of the Connected Devices Platform components listed in the vendor advisory.

Workarounds

If immediate patching is not feasible, disable the Connected Devices Platform Service (Cdpsvc) where business functionality permits
Restrict local logon on sensitive systems to administrative personnel only
Apply application control policies to prevent execution of untrusted binaries from standard user contexts

bash

# Query and stop the Connected Devices Platform Service (requires administrator)
sc.exe query Cdpsvc
sc.exe stop Cdpsvc
sc.exe config Cdpsvc start= disabled