Microsoft Windows Connected Devices Platform Service Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in the Connected Devices Platform Service (Cdpsvc) on Microsoft Windows. This vulnerability allows an unauthorized attacker to execute code remotely over the network. It affects several different versions and ranges of Windows, including Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022. The vulnerability arises from improper memory management, leading to a use-after-free condition that can be exploited to execute arbitrary code.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can apply the security update KB5066791 for Windows 10, KB5066793 for Windows 11, KB5066782 for Windows Server 2022, KB5066586 for Windows Server 2019, and KB5066835 for Windows Server 2025. These security updates can be downloaded via the Microsoft Update Catalog.