Windows Program Compatibility Assistant: Heap overflow enables privilege escalation

Summary

A heap-based buffer overflow in the Windows Program Compatibility Assistant Service allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account on the affected system and no user interaction is required. The service is not directly reachable from the internet, but an attacker with an existing foothold could gain full control of the system.

Affected

• Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 before 10.0.20348.5870

Fixed in

Microsoft security update for the affected builds listed above. Install the fixed build or a later build.

Workaround

Unknown. No vendor workaround has been identified.

Exploitation

• No evidence of in-the-wild exploitation found in the sources reviewed.
• No public proof-of-concept exploit found.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the Microsoft security update on all affected systems, prioritizing multi-user systems, shared PCs and servers.
• Check the support status of Windows 10 systems and confirm ESU eligibility; devices that no longer receive updates remain exposed.
• Limit local logon and local administrator rights to reduce the risk of abuse after an initial compromise.
• Monitor the CISA KEV catalogue and raise the priority if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-123388 www.cve.org
• Microsoft Security Update Guide CVE-2026-123388 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:25.