Vulnerabilities
CVE-2026-72969: Windows Program Compatibility Assistant Service Local Privilege Escalation
A local use‑after‑free flaw in the Windows Program Compatibility Assistant Service allows an attacker with user privileges to elevate to SYSTEM. The issue is present in all Windows 10/11 builds that ship with the service and can be remediated by applying the latest Microsoft patch or disabling the service.
What happened
A use‑after‑free condition in the Windows Program Compatibility Assistant Service (PCA Service) permits a local attacker with user‑level access to trigger a memory corruption that results in privilege escalation.
Impact
When exploited, the flaw can elevate the attacker’s privileges to SYSTEM, enabling full control over the affected machine. The vulnerability is local only and requires the attacker to be able to execute code on the target.
Mitigation
Apply the latest Microsoft security update that addresses CVE‑2026‑72969. If patching is not immediately possible, disable the PCA Service via the Services console or group policy to eliminate the attack surface.
Detection
Monitor for anomalous memory access patterns or unexpected privilege changes. Use Sysmon event ID 10 (Image Load) and 11 (Create File) to detect suspicious activity around the PCA Service executable.
Related vulnerabilities
CVE-2026-72934: Local Privilege Escalation via Windows Program Compatibility Assistant Service Use‑After‑Free
Microsoft identified a use‑after‑free flaw in the Windows Program Compatibility Assistant Service that allows a local attacker with user‑level access to gain SYSTEM privileges. The vulnerability exists in all current Windows 10 and 11 builds that include PCAS. Administrators should apply the latest cumulative update, disable the service where possible, and monitor for privilege‑escalation indicators.
Read briefing
CVE-2026-83826: Windows Error Reporting Privilege Escalation Vulnerability
A local privilege escalation flaw in Windows Error Reporting allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. The issue affects all Windows 10/11 installations that have Error Reporting enabled. Apply the latest security update or disable the service to mitigate.
Read briefing
CVE-2026-83583: Local Privilege Escalation via Windows Geotag Broker
A local privilege escalation flaw in the Windows Geotag Broker service allows an attacker with user-level access to gain elevated rights. The vulnerability is mitigated by installing the latest Windows update and disabling the Geotag Broker if not needed.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing