Microsoft Windows CVE-2026-45487

Attacker must already be able to execute code locally as an authenticated standard user (PR:L, AV:L) on a vulnerable, unpatched Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, or Windows Server 2022/2025 host where the Program Compatibility Assistant Service (PcaSvc) is running - its default state on client and server SKUs. Exploitation requires winning a TOCTOU race against PcaSvc between its validation and use of a target resource (AC:H), which typically demands repeated, precisely timed attempts and is non-deterministic; no user interaction is required (UI:N), and the attack does not work remotely, against accounts without local logon rights, or on hosts where PcaSvc is disabled.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H produces a 7.0 (High) score: exploitation needs local access, low privileges (standard user), and high attack complexity because winning a race window is non-deterministic and typically requires repeated attempts and precise timing. Real-world risk signals are modest and consistent: EPSS is 0.05% (17th percentile), CISA SSVC marks Exploitation as 'none' and Automatable as 'no' while Technical Impact is 'total', and there is no KEV listing and no public exploit identified at time of analysis. The practical picture is a credible post-compromise escalation primitive - useful to an attacker who already has code execution as a local user (malware, phishing payload, or hands-on-keyboard) - but not a mass-exploitation candidate; patch it on the normal Patch Tuesday cycle, prioritized higher on multi-user systems (terminal servers, shared workstations, jump hosts) where untrusted users routinely log in.

A standard-user attacker who has already obtained code execution on the host - for example via a phishing payload or a malicious USB-delivered binary - runs a small helper that repeatedly triggers PCA Service operations while concurrently swapping a watched file or path between the service's check and use steps. After winning the race window, the swapped resource is processed under the elevated context of PcaSvc, giving the attacker SYSTEM-level privileges from which to disable defenses, install persistence, or pivot. No public exploit identified at time of analysis.