Program Compatibility Assistant CVE-2026-96920

Exploitation requires the attacker to already have local, authenticated access to the host as a low-privileged (standard) user and the ability to run or inject code that interacts with the Program Compatibility Assistant Service (PcaSvc), which is present and running by default on supported Windows editions. The key limiting factors are: (1) a pre-existing low-privilege foothold is mandatory (PR:L) - this is not remotely reachable; (2) the attack vector is local only (AV:L), so no network-based exploitation path exists; and (3) a patched build (per the EUVD version thresholds, e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761) removes the vulnerable code. No special non-default configuration is required.

This is a CVSS 7.8 (High) local privilege-escalation flaw (CWE-122 heap-based buffer overflow) in the Windows Program Compatibility Assistant Service. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attacker who already holds low-level (standard user) privileges can, with low complexity and no user interaction, achieve full confidentiality, integrity, and availability impact - i.e., elevate to SYSTEM. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these signals; absence of these signals is not evidence that exploitation is impossible, only that it is unconfirmed. The realistic priority is MODERATE: the local attack vector and required pre-existing authenticated foothold (PR:L) mean this is not a remotely wormable issue, but it is a valuable second-stage escalation primitive, and because the affected product is Windows itself, the deployment footprint is enormous. No conflicting signals were detected - the CVSS local vector is fully consistent with the description's 'elevate privileges locally' wording.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a malicious document, or a compromised standard-user account) runs a crafted local program that sends malformed input to the Program Compatibility Assistant Service, triggering the heap buffer overflow to execute code at SYSTEM privilege. No user interaction and no network access is required. No public exploit was identified in the provided data at the time of analysis.