Vulnerabilities
CVE-2026-72934: Local Privilege Escalation via Windows Program Compatibility Assistant Service Use‑After‑Free
Microsoft identified a use‑after‑free flaw in the Windows Program Compatibility Assistant Service that allows a local attacker with user‑level access to gain SYSTEM privileges. The vulnerability exists in all current Windows 10 and 11 builds that include PCAS. Administrators should apply the latest cumulative update, disable the service where possible, and monitor for privilege‑escalation indicators.
What happened
A use‑after‑free bug in the Windows Program Compatibility Assistant Service (PCAS) was discovered. When the service processes a malformed request, it can reference freed memory, allowing an attacker to execute arbitrary code with elevated privileges.
Impact
Local users who can trigger the flaw can elevate to SYSTEM, enabling full control over the affected machine. The flaw is exploitable on all Windows 10 and 11 releases that ship with PCAS enabled.
Mitigation
- Install the latest cumulative update that addresses CVE‑2026‑72934.
- On servers or devices that do not require PCAS, disable the service via Group Policy or the Services console.
- Apply the principle of least privilege: restrict local user accounts and enforce strong authentication.
Monitoring
Watch for anomalous process creation, unexpected SYSTEM‑level activity, and repeated use‑after‑free patterns in memory dumps. Enable audit logging for privilege‑escalation events.
Related vulnerabilities
CVE-2026-72969: Windows Program Compatibility Assistant Service Local Privilege Escalation
A local use‑after‑free flaw in the Windows Program Compatibility Assistant Service allows an attacker with user privileges to elevate to SYSTEM. The issue is present in all Windows 10/11 builds that ship with the service and can be remediated by applying the latest Microsoft patch or disabling the service.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing
CVE-2026-83690: Windows Kernel Use‑After‑Free Privilege Escalation
A local use‑after‑free flaw in the Windows kernel allows an attacker with local access to gain SYSTEM privileges. Microsoft has released a patch in the latest cumulative update. Defenders should apply the update immediately and enforce least‑privilege controls.
Read briefing
CVE-2026-70056: Windows Update Service Use-After-Free Allows Local Privilege Escalation
A use‑after‑free flaw in the Windows Update Service (wuauserv) lets an authorized local user gain SYSTEM privileges. The vulnerability affects Windows 10 and Windows 11 systems and can be mitigated by installing the latest Microsoft patch and enforcing least‑privilege controls.
Read briefing