{"id":"CVE-2026-123388","kind":"vulnerability","aliases":["CVE-2026-123388"],"related":[],"title":"Windows: heap overflow in Program Compatibility Assistant lets local users gain privileges","description":"Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Program Compatibility Assistant Service lets an authorized local user elevate their privileges. The sources rate it high severity (CVSS 7.8) and do not say it is exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","windows","windows-server"],"not_affected_if":[],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the full build (e.g. 10.0.26100.xxxx) to the fixed builds listed. Anything lower is exposed. Whether the service is on by default is unconfirmed.","fix":"Install the November 2026 Patch Tuesday cumulative update for your Windows version. Fixed builds per Microsoft CNA data (via OpenCVE): Win10 1607/Server 2016 10.0.14393.9688, 1809/Server 2019 10.0.17763.9487, Win10 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. KB numbers unconfirmed; see the MSRC page.","status":"open","published_at":"2026-11-10T19:20:42+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","triaged_at":"2026-11-10T19:38:52+00:00","updated_at":"2026-11-10T21:32:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: heap overflow in Program Compatibility Assistant lets local users gain privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Program Compatibility Assistant Service lets an authorized local user elevate their privileges. The sources rate it high severity (CVSS 7.8) and do not say it is exploited in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-123388 to confirm affected Windows builds, the patched KB, and whether the service is on by default.","how_to_check":"unknown","plain_action":"","product_name":"Windows Program Compatibility Assistant Service","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running Windows with the Program Compatibility Assistant Service present, where a user already has an account on the system. The sources do not list affected Windows builds or whether the service is disabled by default, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4501,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-123388 to confirm affected Windows builds, the patched KB, and whether the service is on by default.","search":"'-123388':15A,18A '-2026':14A,17A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':26A '2016':23A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A '7.8':93B 'allow':115C 'assist':7A,76B,113C 'attack':118C 'author':80B,117C 'base':68B,106C 'buffer':69B,107C 'compat':6A,75B,112C 'cve':13A,16A 'cvss':92B 'elev':83B,120C 'escal':60B 'exploit':100B 'gain':11A 'heap':2A,67B,105C 'heap-bas':66B,104C 'high':90B 'infrastructur':56B 'let':8A,78B 'local':9A,58B,81B,122C 'local-privilege-escal':57B 'overflow':3A,70B,108C 'privileg':12A,59B,85B,121C 'program':5A,74B,111C 'rate':88B 'say':97B 'server':22A,27A,51A,54A,64B 'servic':77B,114C 'sever':91B 'sourc':87B 'user':10A,82B 'wild':103B 'window':1A,61B,63B,73B,110C 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A 'windows-serv':62B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2016/2019/2022/2025 machine below the November 2026 patched build is listed as affected. An attacker needs a local low-privilege account (AV:L, PR:L, no user interaction), so shared servers, RDS/terminal servers, developer and CI Windows hosts matter most. Single-user machines with no untrusted local code have lower risk. Whether the service runs by default is not confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-123388':15A,18A '-2026':14A,17A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':26A '2016':23A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'assist':7A 'compat':6A 'cve':13A,16A 'gain':11A 'heap':2A 'let':8A 'local':9A 'overflow':3A 'privileg':12A 'program':5A 'server':22A,27A,51A,54A 'user':10A 'window':1A 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","search_b":"'7.8':93B 'assist':76B 'author':80B 'base':68B 'buffer':69B 'compat':75B 'cvss':92B 'elev':83B 'escal':60B 'exploit':100B 'heap':67B 'heap-bas':66B 'high':90B 'infrastructur':56B 'let':78B 'local':58B,81B 'local-privilege-escal':57B 'overflow':70B 'privileg':59B,85B 'program':74B 'rate':88B 'say':97B 'server':64B 'servic':77B 'sever':91B 'sourc':87B 'user':82B 'wild':103B 'window':61B,63B,73B 'windows-serv':62B","search_c":"'allow':115C 'assist':113C 'attack':118C 'author':117C 'base':106C 'buffer':107C 'compat':112C 'elev':120C 'heap':105C 'heap-bas':104C 'local':122C 'overflow':108C 'privileg':121C 'program':111C 'servic':114C 'window':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123388","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123388","severity":null,"published_at":"2026-11-10T19:20:42+00:00","modified_at":"2026-11-10T19:20:42+00:00","first_seen_at":"2026-11-10T19:25:12+00:00","fetched_at":"2026-11-10T19:25:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123388:2806","url":"https://app.opencve.io/cve/CVE-2026-123388","severity":null,"published_at":"2026-11-10T21:32:31+00:00","modified_at":"2026-11-10T21:32:31+00:00","first_seen_at":"2026-11-10T21:32:31+00:00","fetched_at":"2026-11-10T21:32:31+00:00","note":"MSRC page not readable by tools (JS-only), so nothing verified. Build numbers come from Microsoft's CNA record as mirrored by OpenCVE. KB numbers not found. Vector has E:U (no exploitation reported); KEV false.","cites":["https://app.opencve.io/cve/CVE-2026-123388","https://www.rapid7.com/db/vulnerabilities/cve-2026-123388/"]}],"documents":[{"id":118912,"url":"https://app.opencve.io/cve/CVE-2026-123388","title":"OpenCVE: CVE-2026-123388 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118913,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-123388/","title":"Rapid7 DB: CVE-2026-123388","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}