Windows PCA Service CVE-2026-69563

The attacker must already hold a low-privileged (PR:L) local interactive or network session on the affected Windows system - a standard user account suffices. The PCA Service must be running, which is the default on consumer Windows installations; Server Core deployments may have reduced attack surface. AC:H indicates a specific heap state, race window, or environmental condition must be satisfied for reliable exploitation - this is not a simple one-shot trigger. Exploitation is local-only (AV:L); no network path exists independent of initial access. Factors limiting exploitation: (1) attacker must already have code execution at low privilege, (2) high attack complexity implies unreliable exploitation without a polished, tailored exploit, and (3) no public exploit code is confirmed at time of analysis.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a meaningful but non-trivial local privilege escalation. AV:L confirms exploitation is constrained to an attacker already executing code on the target system; PR:L means even a standard domain or local user account suffices. AC:H is the primary limiting factor - it indicates that reliable exploitation requires a race condition, heap grooming, or other timing-dependent technique, which raises the bar significantly beyond point-and-click exploitation. The impact metrics C:H/I:H/A:H with S:U indicate full compromise of the local system without lateral scope change. No KEV listing and no public exploit code reduce near-term urgency relative to a CVSS score alone would suggest; this is a candidate for inclusion in normal patch cycles rather than emergency response. EPSS data was not provided, so statistical exploitation probability cannot be assessed.

An attacker with a low-privileged local account - such as a standard domain user, a compromised service account, or a user on a shared Windows terminal server - triggers a malformed compatibility-check request to the PCA Service, causing a heap buffer overflow. By timing the operation to exploit a race condition or pre-grooming the process heap, the attacker corrupts adjacent memory structures to redirect execution into attacker-controlled code running at SYSTEM privilege. No public exploit code has been confirmed, meaning a working exploit would currently require significant heap-exploitation expertise.