CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation

What happened

Microsoft identified a use‑after‑free bug in the Windows Application Compatibility Cache that can be triggered by an authorized user to elevate privileges locally. The flaw allows the attacker to corrupt the cache data structures and execute arbitrary code with SYSTEM rights.

Impact

All Windows versions that implement the compatibility cache are potentially vulnerable, including Windows 10, 11, and Server editions. Successful exploitation results in local privilege escalation, enabling the attacker to install malware, bypass controls, or exfiltrate data.

Mitigation

Apply the latest cumulative security update from Microsoft that addresses CVE‑2026‑72955. Until a patch is available, restrict write access to the cache directory (C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Compatibility) and monitor for abnormal process creation.

What to do

• Run Windows Update and confirm that the KB for CVE‑2026‑72955 is installed.
• Verify that the Application Compatibility Cache service is running with the least privilege.
• Enable auditing of the cache directory and alert on unauthorized modifications.
• Consider disabling the compatibility cache if not required for legacy applications.