EUVD-2026-73199
GHSA-c8fr-xhx3-v5v7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low privilege required (AV:L/PR:L); no complexity or interaction; SYSTEM-level heap overflow justifies full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows endpoints. The flaw spans an exceptionally broad swath of Microsoft's Windows ecosystem - from Windows 10 version 1607 and Windows Server 2012 through current Windows 11 and Server 2025 releases - making it a high-priority local escalation primitive across enterprise environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged authenticated local session on the target system (CVSS AV:L/PR:L); remote network-based exploitation is explicitly ruled out by the local attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 (High) score with vector AV:L/AC:L/PR:L/UI:N accurately reflects a practical local privilege escalation primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for all affected Windows versions as specified in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68845. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct asset discovery to enumerate all Windows endpoints and assess patch deployment readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today