CVE-2026-62696: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62696 Overview

CVE-2026-62696 is an integer underflow vulnerability [CWE-191] in the Windows Program Compatibility Assistant (PCA) Service. An authorized local attacker can trigger arithmetic wraparound to elevate privileges on the affected host. Microsoft rates the issue High with a CVSS 3.1 base score of 7.8. The flaw affects every currently supported Windows client and Windows Server release, from Windows 10 1607 and Windows Server 2016 through Windows 11 26H1 and Windows Server 2025. Exploitation requires local access with low privileges and no user interaction, making the vulnerability relevant to any endpoint where an attacker or malicious process can execute code as a standard user.

Critical Impact
Successful exploitation yields full confidentiality, integrity, and availability impact on the host, allowing a low-privileged user to gain SYSTEM-level access through the Program Compatibility Assistant Service.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62696 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62696

Vulnerability Analysis

The Windows Program Compatibility Assistant Service (PcaSvc) runs with elevated privileges and processes compatibility metadata submitted by user-mode components. CVE-2026-62696 is classified as an integer underflow (wrap or wraparound) weakness tracked under [CWE-191]. A crafted input causes an unsigned arithmetic operation to wrap below zero, producing an unexpectedly large value that is then used in subsequent size, offset, or index calculations. The malformed value drives memory operations outside the intended bounds, corrupting service-owned state that runs under NT AUTHORITY\SYSTEM. An attacker with a valid local session can chain this corruption into arbitrary code execution in the security context of the PCA service, resulting in local privilege escalation.

Root Cause

The root cause is missing or incorrect bounds validation before an arithmetic subtraction in the PCA service's request-handling path. When an attacker supplies a value smaller than an assumed baseline, the unsigned subtraction wraps around, yielding a size or length treated as valid by downstream code. This class of defect commonly enables heap corruption, out-of-bounds writes, or logic bypasses within the affected component.

Attack Vector

The attack vector is local and requires low-privileged authentication. No user interaction is required. An attacker executes code as a standard user, opens a handle or IPC channel exposed by the Program Compatibility Assistant Service, and submits crafted parameters that trigger the underflow. The resulting corruption is leveraged to hijack execution flow inside the SYSTEM-privileged service. Microsoft has not published exploitation details, and no public proof-of-concept is available at the time of writing. See the Microsoft CVE-2026-62696 Advisory for vendor guidance.

Detection Methods for CVE-2026-62696

Indicators of Compromise

Unexpected crashes, restarts, or Watson error reports referencing the PcaSvc service or the pcasvc.dll module
Child processes spawned by svchost.exe hosting PcaSvc that run interactive shells, cmd.exe, powershell.exe, or LOLBins with SYSTEM privileges
New scheduled tasks, services, or local administrator accounts created shortly after PCA service anomalies on the same host

Detection Strategies

Alert on process ancestry where the svchost.exe -k netsvcs instance hosting PcaSvc becomes the parent of user-mode utilities not typical for compatibility workflows
Monitor Windows Error Reporting and application crash telemetry for repeated faults in pcasvc.dll on the same host, which can indicate exploitation attempts against the underflow
Correlate standard-user logons with subsequent SYSTEM-context process creation events on the same endpoint within a short window

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command-line logging and forward events to a centralized analytics platform
Track service state changes for PcaSvc (Event IDs 7031, 7034, 7036) that may indicate exploitation-induced instability
Review token elevation and privilege assignment events (Event IDs 4672, 4673) for accounts that should not routinely acquire SYSTEM-equivalent privileges

How to Mitigate CVE-2026-62696

Immediate Actions Required

Deploy the Microsoft security update referenced in the Microsoft CVE-2026-62696 Advisory to all affected Windows 10, Windows 11, and Windows Server systems
Prioritize patching on multi-user hosts, jump boxes, Remote Desktop Session Hosts, and Virtual Desktop Infrastructure where low-privileged users can execute code
Audit endpoints for unauthorized local privilege escalation activity prior to patch deployment using EDR telemetry and Windows event logs

Patch Information

Microsoft has issued fixes through its Security Update Guide. Administrators should consult the Microsoft CVE-2026-62696 Advisory to identify the specific KB articles applicable to each affected Windows build and apply them through Windows Update, Windows Server Update Services, Microsoft Intune, or Configuration Manager.

Workarounds

If patching must be delayed, restrict interactive and Remote Desktop logons to trusted administrators on systems that cannot immediately be updated
Consider disabling the Program Compatibility Assistant Service (PcaSvc) on servers where application compatibility shimming is not required, after validating operational impact in a test environment
Enforce application control policies such as Windows Defender Application Control or AppLocker to limit unsigned or untrusted binaries that could stage the exploit

bash

# Configuration example: query and stop the Program Compatibility Assistant Service on a non-critical host
sc.exe query PcaSvc
sc.exe config PcaSvc start= disabled
sc.exe stop PcaSvc