Windows AppCompat Cache CVE-2026-72955

Exploitation requires the attacker to already possess local, authenticated low-privileged code execution on the target host (CVSS PR:L, AV:L) - this is a post-compromise escalation, not a remote entry point. The flaw is in the Windows Application Compatibility Cache (shimcache) subsystem, exercised through normal local process/API interaction, so no special non-default feature toggle is named in the description. The primary limiting factor is the use-after-free race condition reflected by AC:H: the attacker must reliably reclaim the freed object in a narrow timing window, which makes exploitation unreliable and non-automatable (SSVC Automatable: no) and typically requires multiple attempts. No user interaction is required (UI:N). Affected are unpatched builds across Windows 11 (23H2 through 26H2), Windows Server 2022, and Windows Server 2025 (including Server Core) below the fixed build numbers listed in the EUVD data.

This is a genuine but moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/C:H/I:H/A:H = 7.0 High) tells a consistent story: the attacker must already have local, low-privileged code execution on the host (PR:L, AV:L) and must win a race or meet a hard-to-control condition (AC:H), which is typical for a CWE-416 use-after-free. All exploitation signals point AWAY from urgency: CISA SSVC lists Exploitation as 'none', Automatable as 'no' (consistent with AC:H - it cannot be reliably sprayed at scale), with Technical Impact 'total' (consistent with C:H/I:H/A:H - full SYSTEM-level compromise if the race is won). The CVE is not on CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - treat that as a data gap, not a low score. The one conflicting signal is the input Tags, which include 'Denial Of Service' while the description and SSVC describe a total-impact elevation of privilege; the DoS label is plausible as a secondary memory-corruption effect but is not the primary vulnerability class and should not be read as the main risk. Net: a reliable post-compromise escalation primitive on an ubiquitous platform, but gated behind existing local access and a high-complexity race - patch in normal cadence, prioritizing multi-user/shared and high-value hosts.

A low-privileged user (or malware already running under a standard account) executes crafted code that manipulates the Windows Application Compatibility Cache to trigger a use-after-free, racing the freed-object reuse to gain control of a dangling pointer. Winning the race lets the attacker corrupt kernel/privileged memory and elevate to SYSTEM. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means exploitation is not reliable on the first attempt.