Windows PCA Service CVE-2026-68876

Exploitation requires: (1) a valid low-privileged account on the target system or domain (PR:L), consistent with the vendor's description of an 'authorized attacker'; (2) network reachability to the target host where the PCA service is exposed (AV:N); and (3) user interaction on the target, likely involving a legitimate user triggering a compatibility check or interacting with a crafted application (UI:R). The service runs by default on Windows client and server installations, so no non-default configuration is required for the service to be present. Exploitation is limited by the user-interaction dependency, which prevents fully automated, wormable attack chains. Additionally, modern Windows mitigations such as Control Flow Guard (CFG) and heap hardening increase the practical complexity of reliably exploiting heap overflows, potentially raising the effective attack complexity above the AC:L assessment for some target configurations.

The CVSS 8.0 score reflects meaningful real-world risk: AV:N confirms the exploit path traverses the network rather than requiring local machine access, AC:L indicates no unusual preconditions, and PR:L confirms a low-privileged account suffices - consistent with the vendor's description of an 'authorized attacker.' UI:R introduces a dependency on user interaction, which is the primary mitigating factor limiting opportunistic mass exploitation. The S:U/C:H/I:H/A:H combination appropriately captures full local-system compromise once privileges are elevated. No EPSS score was provided in the input data, and the CVE is not listed in CISA KEV, suggesting no confirmed widespread exploitation at time of analysis. No public POC has been identified. The combination of network reachability, low privilege bar, and complete post-exploitation impact makes this a high-priority patch target: organizations running unpatched Windows Server 2012 through 2025 with network-accessible PCA service exposure and multiple user accounts should treat remediation as urgent.

An attacker with a low-privileged domain or local account sends a crafted network request to the Program Compatibility Assistant Service on a target Windows host, inducing the victim's session or service to process a malformed message that triggers the heap buffer overflow. Successful memory corruption overwrites a function pointer or critical heap metadata, redirecting execution to attacker-controlled code running as SYSTEM. No public proof-of-concept exists at time of analysis, so exploitation likely requires non-trivial heap-grooming skill.