Windows PCASvc EUVD-2026-99894

Exploitation requires the attacker to already have authenticated low-privileged local code execution on the Windows host (CVSS PR:L) and to interact with the Program Compatibility Assistant Service (pcasvc), the specific component containing the use-after-free. Successful exploitation is gated by a high-complexity condition (AC:H) characteristic of UAF races - the attacker must reliably reclaim the freed object with attacker-controlled memory, often requiring repeated timing-sensitive attempts. There is no remote or unauthenticated path and no user interaction is required (UI:N); the limiting factors are the mandatory local foothold and the race-condition reliability, both of which substantially raise the practical bar beyond the raw 7.0 score.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local-only privilege escalation requiring an attacker to already hold low-level authenticated access (PR:L) and to win a difficult race or satisfy a hard-to-control precondition (AC:H), which is typical of use-after-free flaws. The SSVC decision framework reinforces a measured posture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AC:H - the UAF cannot be reliably mass-triggered), while Technical Impact is 'total' (consistent with C:H/I:H/A:H full SYSTEM compromise on success). Signals are internally consistent and point to a reliability-limited local EoP rather than a mass-exploitation threat. No CISA KEV listing and no EPSS score were provided in the input; absence of these is not evidence of safety but does mean there is no current data suggesting active or widespread exploitation. One metadata conflict exists: the input Tags include 'Denial Of Service', but the description and CVSS impact (C:H/I:H/A:H, privilege elevation) describe code-execution-grade privilege escalation, not a DoS - treat the DoS tag as likely mislabeled. Net: patch on a normal prioritized cadence as part of Patch Tuesday hygiene; it is not a drop-everything emergency absent exploitation evidence.

An attacker who has already obtained standard low-privileged code execution on a Windows host (for example via a phishing payload or a compromised service account) triggers a use-after-free in the Program Compatibility Assistant Service to corrupt memory and elevate to SYSTEM. Because AC:H reflects a race or timing-dependent condition, the attacker may need multiple attempts before the dangling pointer is reclaimed with attacker-controlled data. No public exploit code has been identified at time of analysis.