Program Compatibility Assistant CVE-2026-72934

Exploitation requires the attacker to already possess a low-privileged authenticated local session on the target host (PR:L, AV:L) and to run code locally that triggers the use-after-free in the Windows Program Compatibility Assistant Service (PcaSvc). The high attack complexity (AC:H) reflects a race-condition / timing-dependent UAF that the attacker must win to reliably corrupt freed memory, which is the principal limiting factor along with the need for prior local access and an authenticated account. No user interaction by another user is needed (UI:N). The vulnerability affects specific Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 builds below the listed patched versions, so fully patched systems are not exposed.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local-only privilege escalation requiring an already-authenticated low-privileged account and a high-complexity attack - consistent with a use-after-free race condition (CWE-416) that must win a timing window to be reliably triggered. Multiple exploitation signals agree on LOW urgency: SSVC reports Exploitation=none, Automatable=no (meaning it cannot be reliably mass-exploited), though Technical Impact=total aligns with the full C:H/I:H/A:H triad. There is no CISA KEV listing and no POC indicator in the provided data, so the status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so quantitative exploitation probability cannot be stated. The signals are internally consistent - local vector, high complexity, SSVC 'none/no' - so there is no network-vs-local contradiction to resolve here. The main mitigating factors are that the attacker must already have a foothold (PR:L) and overcome AC:H; the aggravating factor is total technical impact and a patch already shipping, which typically shortens the window before exploit development. Realistically this is a post-compromise privilege-escalation building block rather than an initial-access or wormable threat.

An attacker who already has a low-privileged authenticated session on a Windows 11 or Server 2025 host (e.g. via phishing, a stolen credential, or a prior low-impact bug) runs a local program that races the Program Compatibility Assistant Service to trigger the use-after-free, corrupting memory to execute code at higher privilege. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) means the race must be won reliably, so successful escalation is not guaranteed on a single attempt.