Windows PCA Service CVE-2026-68874

Exploitation requires a valid low-privilege account on the target Windows system (PR:L) - unauthenticated remote exploitation is not possible per the CVSS vector. Additionally, user interaction is required (UI:R), meaning a user or process must invoke a compatibility check (e.g., by launching an application monitored by PcaSvc) during or around the time of attack. The vulnerable code path is network-reachable (AV:N), so the attacker does not need local console access. Limiting factors are: the attacker must possess valid credentials, and the timing dependency on user interaction reduces the reliability of automated exploitation at scale. No specific non-default configuration is identified as a prerequisite - the PCA service runs by default on affected Windows versions.

The CVSS 5.7 (Medium) rating is consistent with the vector: network-reachable, low complexity, but gated behind authenticated access (PR:L) and user interaction (UI:R), limiting opportunistic mass exploitation. The confidentiality impact is rated High (C:H), meaning a successful read could expose meaningful memory contents - potentially credential material, session tokens, or other sensitive data resident in the service's address space - but no integrity or availability impact is present. EPSS data is not provided in the input; given the authentication and interaction prerequisites, real-world exploitation probability is expected to be moderate at best. There is no KEV listing, and no public POC has been identified, further reducing near-term urgency. The breadth of affected platforms (19 distinct version-build combinations across Windows 10, 11, and six Server releases) means the aggregate exposed population is very large, and even a mid-sized municipal IT team in swidnica should treat this as a standard patch-cycle priority rather than an emergency response. The mismatch between 'Buffer Overflow' tag in the input and the actual CWE-125 classification is worth noting: this is a read-side flaw, not a write-side memory corruption, which meaningfully limits exploitation to information disclosure rather than code execution.

An authenticated low-privileged domain user on a network-accessible Windows system triggers a compatibility check - for example by launching an application that invokes PcaSvc - causing the service to perform an out-of-bounds read and return leaked memory contents to the attacker over the network. No public exploit code has been identified, so this scenario requires manual exploitation or bespoke tooling. The leaked data could include portions of the service's heap containing sensitive information such as cached credentials or token material.