Program Compatibility Assistant EUVD-2026-73413

Exploitation requires an interactive or remote desktop session with at least a low-privilege (standard user) Windows account on an affected build of Windows 11 (23H2, 24H2, 25H2, 26H1) or Windows Server 2025. No network-facing component is involved - the attacker must have local logon access. The log files must be accessible with standard user read permissions, which is implied by the C:H rating despite PR:L. No special application configuration or non-default feature is required beyond having the Program Compatibility Assistant Service running, which is enabled by default on Windows 11. Exploitation is limited to local-only scenarios; remote unauthenticated exploitation is not possible.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the threat model: exploitation is strictly local, requires only a standard (low-privilege) user account, and has no integrity or availability impact. The High confidentiality rating reflects that whatever is written to the log is considered sensitive, though the specific data type is not disclosed. No EPSS score is provided in the input, and the vulnerability is absent from CISA KEV, indicating no confirmed in-the-wild exploitation. No POC has been identified. Real-world prioritization is moderate: the local-only attack vector meaningfully limits exposure compared to network-reachable flaws, but Windows 11 and Server 2025 are widely deployed, and any authenticated local user on a multi-user or RDS-style system could leverage this to read information they should not have access to. The primary realistic threat actor is a low-privileged insider or a post-compromise attacker seeking lateral-movement intelligence from log contents.

An attacker with a standard domain or local user account on a shared Windows 11 or Server 2025 system locates the Program Compatibility Assistant log files on disk - typically in a path writable or readable by non-administrative users - and extracts sensitive information logged by PcaSvc. This data could then inform further lateral movement or privilege escalation efforts. No exploit code is known to exist, and the attack requires physical or remote interactive logon access.