Windows Program Compatibility Assistant Service: Elevation of privilege via heap overflow

Summary

The Windows Program Compatibility Assistant (PCA) Service, a Windows component, is affected in several Windows 10, Windows 11 and Windows Server versions. A local attacker with an existing low-privileged session can exploit a heap-based buffer overflow (CWE-122) to elevate privileges. No internet exposure or user interaction is required, but the attacker must already have a foothold on the system.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to < 10.0.14393.9612; CPE in the NVD record)
• Windows 10 Version 1809 (builds 10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2016 incl. Server Core (builds 10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2019 incl. Server Core (builds 10.0.17763.0 to < 10.0.17763.9376)
• Windows Server 2022 (builds 10.0.20348.0 to < 10.0.20348.5761)

Fixed in

• Install the Microsoft security update for the affected build (fixed builds per CNA record: 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807, 10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.28000.3231, 10.0.26300.9711, 10.0.20348.5761)
• Knowledge base (KB) numbers: Unknown. Retrieve them from the MSRC Security Update Guide before patching.

Workaround

• No Microsoft workaround known.
• Third-party aggregator suggests disabling the PCA service if legacy compatibility is not needed, or running it with least privilege. This is not a vendor recommendation and may affect legacy applications.

Exploitation

• Microsoft marks the vulnerability as not exploited.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept found in the research searches.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems and identify affected builds.
• Patch affected systems in the next patch cycle, prioritising multi-user systems, terminal servers and RDS hosts.
• Verify the fixed build for each product on the MSRC page, as some third-party data contains inconsistencies.
• Check whether Windows 10 1607 is still supported; if it is out of support, plan a replacement.
• Review the PCA service disable option only where legacy applications are confirmed unused and after testing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96920 msrc.microsoft.com
• CNA record mirror (Vulners) vulners.com
• NVD/CVE mirror with SSVC and CVSS (OpenCVE) app.opencve.io
• Third-party product table (Strix) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:43.