Windows PCA Service EUVD-2026-73199

Exploitation requires a low-privileged authenticated local session on the target system (CVSS AV:L/PR:L); remote network-based exploitation is explicitly ruled out by the local attack vector. The attacker must be able to interact with or submit input to the Program Compatibility Assistant Service through the normal mechanisms available to any logged-in user - no administrator rights, no special group membership, and no non-default configuration are documented as prerequisites. No user interaction beyond the attacker's own actions is required (UI:N). The primary limiting factor is the requirement for existing local code execution: this vulnerability cannot be weaponized for initial network access and is strictly a post-compromise privilege escalation primitive. All supported Windows versions running the PCA service in its default-enabled state appear to be within scope.

The CVSS 7.8 (High) score with vector AV:L/AC:L/PR:L/UI:N accurately reflects a practical local privilege escalation primitive. The local attack vector (AV:L) constrains initial access - an attacker must already hold a low-privileged authenticated local session, meaning this is not an initial intrusion vector but a post-compromise escalation tool. However, the AC:L rating signals that the overflow can be triggered reliably without race conditions or special timing, and the absence of required user interaction (UI:N) means exploitation is fully attacker-controlled. No EPSS data was provided; no CISA KEV listing exists; no POC has been disclosed, so real-world exploitation is unconfirmed. That said, the combination of broad version coverage (19 distinct Windows SKU/version combinations) and low exploitation complexity elevates this above a typical theoretical finding - any threat actor with an initial foothold would find this a reliable path to SYSTEM. The unchanged scope (S:U) limits direct blast radius to the compromised host, but SYSTEM access enables credential dumping and further lateral movement as secondary effects.

An attacker who has obtained a low-privileged shell on a target Windows host - through a phishing payload, credential theft, or lateral movement from another compromised endpoint - crafts a malformed input that triggers the heap overflow within the Program Compatibility Assistant Service. The overflow corrupts heap control structures or function pointers, redirecting execution flow to attacker-controlled code running in the PCA service's SYSTEM context. No public exploit code is known at time of analysis, but the AC:L rating suggests a reliable, reproducible trigger once the internal code path is mapped.