Windows PCA Service EUVD-2026-56346

The attacker must hold a valid, low-privileged local Windows account on the target system (PR:L per CVSS). The attack is local-only (AV:L) - remote unauthenticated exploitation is not possible. No user interaction from a victim is required (UI:N). The Windows Program Compatibility Assistant Service (PcaSvc) must be running, which is its default state on desktop and server editions. No non-default configuration is required to expose the vulnerability. Exploitation is not automatable per SSVC, implying the triggering mechanism requires deliberate, targeted interaction rather than a network-wide worm-style approach. The key limiting factor is the requirement for prior authenticated local access.

The CVSS 7.8 score is well-supported by the vector metrics: AV:L indicates local access is required, AC:L reflects low complexity, PR:L means a standard user account suffices, and the high C/I/A triad confirms full system compromise potential. This is a classic local privilege escalation profile - high severity within its scope but not remotely exploitable. SSVC signals reinforce this: exploitation is rated 'none' and the attack is not automatable, which together argue against imminent mass exploitation even though technical impact is rated total. No EPSS score was provided in the source data; absence of that signal leaves exploitation probability uncertain. CISA KEV listing is absent, and no public proof-of-concept has been identified at time of analysis. The realistic threat model here is an insider or post-compromise lateral movement scenario: an attacker who has already obtained a low-privileged foothold on a Windows host exploits this flaw to escalate to SYSTEM, making it a high-value link in an attack chain rather than a standalone entry point. Patch Tuesday remediation should be prioritized on endpoints accessible to untrusted or semi-trusted users.

An attacker who has compromised a low-privileged domain user account - through phishing or credential theft - logs into an unpatched Windows workstation or server. By invoking a crafted interaction with the Program Compatibility Assistant Service that triggers the integer underflow, the attacker causes the service to operate on a pathologically large buffer size, overwriting controlled memory within the SYSTEM-privileged service process and ultimately executing arbitrary code as SYSTEM. No public exploit code has been identified at time of analysis, so exploitation requires custom development.