Program Compatibility Assistant EUVD-2026-99286

Exploitation requires the attacker to already have authenticated low-privileged local access to the host (PR:L, AV:L) and to interact with the Windows Program Compatibility Assistant Service (PcaSvc), which runs by default on affected Windows 11 and Windows Server 2025 builds - so no non-default configuration is needed. The primary limiting factor is the high attack complexity (AC:H): triggering the use-after-free reliably depends on winning a race or precise heap grooming, which reduces reliability. No user interaction is required (UI:N), but there is no remote network path, so this cannot be exploited directly from the network and serves only as a local privilege-escalation step after initial access.

This is a locally-exploitable elevation-of-privilege flaw with a moderate CVSS 3.1 base score of 7.0. The vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent: local attack vector, high attack complexity, and low privileges required, yielding full confidentiality, integrity, and availability impact on the same scope. The high attack complexity (AC:H) is typical for a use-after-free (CWE-416) that depends on winning a race or grooming the heap, which meaningfully raises the bar for reliable exploitation. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread weaponization - this reads as a real-but-not-urgent priority typical of monthly Microsoft servicing-stack EoP bugs rather than a drop-everything emergency. The gating factors are that the attacker must already be an authenticated local user (PR:L) and must overcome AC:H, meaning this is a post-compromise privilege-escalation primitive (SYSTEM takeover from a foothold) rather than an initial-access vulnerability. Given the ubiquity of the affected Windows versions, it should be patched promptly even without exploitation signals.

A low-privileged but authenticated local user runs a crafted program that interacts with the Windows Program Compatibility Assistant Service to trigger a use-after-free, then grooms the freed memory to hijack control flow and execute code in the service's privileged context, elevating to SYSTEM. Because AC:H applies, the attacker likely must win a timing race or reliably shape the heap, so exploitation may require multiple attempts. No public exploit code was identified in the provided intelligence.