Program Compatibility Assistant EUVD-2026-99285

Exploitation requires the attacker to already possess local, authenticated access to the target Windows host (PR:L, AV:L) and the ability to run code that interacts with the Program Compatibility Assistant Service (PcaSvc). The use-after-free is gated by high attack complexity (AC:H), indicating a race condition or specific object-lifecycle/timing state that the attacker does not fully control and may need to trigger repeatedly to win. No user interaction is required (UI:N). Limiting factors: the vector is local-only (not remotely reachable), a pre-existing foothold is mandatory, and the affected service must be present and reachable in the running session (it is a default Windows component). Affected builds are below the patched versions listed in EUVD (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650); patched builds are not exploitable.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Program Compatibility Assistant Service, scored CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a real-but-not-urgent issue: the attacker must already have local, authenticated access (PR:L, AV:L) and must win a race or satisfy specific timing/state conditions to trigger the free-then-reuse (AC:H), which materially raises the exploitation bar. Impact is total once triggered (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating, reflecting likely SYSTEM-level code execution. However, the escalation signals are all low: SSVC 'Exploitation: none' and 'Automatable: no', CISA KEV status is NOT present, and no public proof-of-concept is indicated in the provided data. There is no EPSS score in the input, so statistical exploitation probability cannot be weighed. Net assessment: patch within normal prioritized cycles - it is a credible local EoP with high technical impact, but the high attack complexity, local-only vector, required pre-existing foothold, absence of active exploitation, and non-automatable nature make it a lower real-world priority than a network-reachable or actively exploited flaw. It is a meaningful post-compromise privilege-escalation primitive rather than an initial-access or wormable threat.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, stolen credentials, or a standard user account) runs a crafted local program that interacts with the Program Compatibility Assistant Service to trigger the use-after-free during a specific timing window, corrupting memory to execute code at SYSTEM level and fully compromise the machine. The high attack complexity (AC:H) implies a race condition or precise state manipulation that may require multiple attempts. No public exploit identified at time of analysis.