---
id: "CVE-2026-123388"
page: "https://infrastack.ai/live/CVE-2026-123388"
kind: "vulnerability"
aliases: ["CVE-2026-123388"]
title: "Windows: heap overflow in Program Compatibility Assistant lets local users gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Program Compatibility Assistant Service", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:42+00:00"
first_seen_at: "2026-11-10T19:25:12+00:00"
updated_at: "2026-11-10T19:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123388", "first_seen_at": "2026-11-10T19:25:12+00:00"}]
exploit_sources: []
---

# Windows: heap overflow in Program Compatibility Assistant lets local users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-123388 (this .md is for agents)

A heap-based buffer overflow in the Windows Program Compatibility Assistant Service lets an authorized local user elevate their privileges. The sources rate it high severity (CVSS 7.8) and do not say it is exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Program Compatibility Assistant Service affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T19:25:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123388

## From the sources

Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_