Microsoft Windows: Local privilege escalation in Program Compatibility Assistant Service
Summary
A flaw caused by improper null termination in the Windows Program Compatibility Assistant Service allows an authorized local user to elevate privileges. The attacker needs a low-privilege account on the affected system and local access, so the flaw is not remotely exploitable. A successful attack could give the attacker high confidentiality, integrity and availability impact on the system.
Affected
- Windows 11 version 23H2: 10.0.22631.0 to before 10.0.22631.7652
- Windows 11 version 24H2: 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 version 25H2: 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 version 26H2: 10.0.26300.0 to before 10.0.26300.9711
- Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
- Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650
- Windows 10 and Windows Server 2019: not listed in the sources reviewed; status unknown
Fixed in
- Install the October 2026 Microsoft security update for your Windows version.
- Fixed builds according to the CNA record: 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025).
- Third-party reports cite KB5126653 (Windows 11 23H2) and KB5126646 (Windows Server 2025); these are not yet verified against MSRC.
Workaround
Unknown. No vendor workaround was found. Patching is the documented fix.
Exploitation
- CISA SSVC data in the CVE record: exploitation none, automatable no, technical impact total.
- EPSS score reported as 0.00361 (very low).
- No evidence of exploitation in the wild and no public proof of concept were found. This is not proof of absence.
- CISA KEV status: not found.
Our recommendation
- Install the October 2026 cumulative security update on Windows clients and servers through your normal patch cycle.
- Prioritise shared workstations, terminal or RDS servers, and file servers where several users log on.
- Check whether Windows 10 or Windows Server 2019 systems in your environment are affected and whether they receive extended security updates.
- Monitor for public exploit code, since this is a local privilege escalation.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Program Compatibility Assistant Service
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows
- Updates (KB)
- KB5127648, KB5126655, KB5126646, KB5126653, KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83781 msrc.microsoft.com
- OpenCVE: CVE-2026-83781 app.opencve.io
- Vulners CVE list entry: CVE-2026-83781 vulners.com
- Vulners NVD entry: CVE-2026-83781 vulners.com
- Strix: CVE-2026-83781 www.strix.ai
- Positive Technologies PT-2026-112575 vulners.com
- Qualys October 2026 Patch Tuesday review blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:01.
Original description (NVD)
Improper null termination in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.