Program Compatibility Assistant EUVD-2026-99997

Exploitation requires the attacker to already have an authenticated, low-privileged account and local code-execution capability on the target host (AV:L, PR:L); the specific target is the Windows Program Compatibility Assistant Service (PcaSvc), which is present and running by default on affected Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2022/2025 builds. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a local foothold exists there are no special configuration or interaction barriers. The principal limiting factor is the need for prior local access and valid low-level credentials - this is a post-compromise privilege-escalation primitive, not a remotely reachable flaw, which bounds real-world risk below that of a network-exploitable vulnerability.

This is a credible but not emergency priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local elevation-of-privilege flaw: the attacker must already be authenticated with low privileges (PR:L) and have local access (AV:L), but attack complexity is low (AC:L) and no user interaction is needed. The SSVC framework corroborates a measured risk: Exploitation=none (no observed or public exploitation), Automatable=no (the local, authenticated precondition prevents mass/wormable exploitation), but Technical Impact=total, which aligns with the full C:H/I:H/A:H compromise of the host once triggered. No EPSS score was provided, and there is no CISA KEV listing and no POC referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent - a high-impact but access-gated local bug - rather than conflicting. Note one metadata discrepancy: the input Tags include 'Information Disclosure,' which contradicts the description (privilege elevation) and the full-triad impact of the CVSS vector; this appears to be a mislabel and should not be read as a confidentiality-only issue. Realistic priority: patch in normal cadence as a privilege-escalation building block for post-compromise attackers, not a perimeter emergency.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing or a standard user account) runs a crafted local program that triggers the improper null termination flaw (CWE-170) in the Program Compatibility Assistant Service. Exploitation succeeds without user interaction and, given the low attack complexity, yields SYSTEM-level privileges, enabling full host takeover. No public proof-of-concept or active exploitation has been identified at time of analysis.