Description

Integer underflow (wrap or wraparound) in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:19.130Z",
  "pubdate": "2026-08-11T17:18:19.130Z",
  "executiveSummary": "An integer underflow, also commonly referred to as a wrap or wraparound condition, exists within the Windows Program Compatibility Assistant Service. This security flaw introduces significant risk to host systems by enabling local privilege escalation. Specifically, an authorized threat actor who has already obtained local access to the target machine can manipulate specific data structures or input parameters processed by the vulnerable service. By inducing an integer underflow condition during arithmetic operations, the attacker can cause memory corruption or logic errors that circumvent standard access controls. The impact of successful exploitation includes the unauthorized elevation of privileges from a standard user context to higher integrity levels, such as SYSTEM, potentially allowing complete compromise of the underlying operating system. Because this is a local attack vector, exploitation requires prior local execution capabilities and authorization to interact with the Windows Program Compatibility Assistant Service. The risk implication is severe, as it provides a pathway for an adversary with limited privileges to achieve persistent, high-integrity access and execute arbitrary code within privileged execution contexts.",
  "technicalDetails": "The vulnerability resides in the Windows Program Compatibility Assistant Service, which is responsible for monitoring application compatibility issues and assisting users in running older software correctly. The root cause of the security defect stems from an integer underflow vulnerability, occurring when arithmetic operations on integer variables yield a value that falls below the minimum representable limit of the data type. This unhandled wrap or wraparound condition typically leads to miscalculated buffer sizes, incorrect memory allocation lengths, or flawed bounds checking within the service's internal data processing routines.\nExploitation of this vulnerability requires an attacker to possess local access to the target system and the ability to interact with the Windows Program Compatibility Assistant Service. Although the input description notes that the attacker is authorized, in the context of threat modeling, this refers to having the necessary local system access rights to invoke the affected service interfaces, IPC mechanisms, or API functions exposed by the component.\nThe step-by-step attack flow proceeds as follows: First, the local attacker prepares a specially crafted request, IPC message, or file attribute designed to trigger the vulnerable arithmetic operation within the service. Second, the Windows Program Compatibility Assistant Service receives this input and processes it through internal functions where length or size calculations are performed. Third, due to insufficient validation of input bounds, the arithmetic operation results in an integer underflow, causing a large numerical wrap-around. Fourth, this miscalculated value is subsequently used in subsequent memory management operations, such as allocating a heap buffer or copying data. Fifth, the discrepancy between the allocated buffer size and the actual data copied leads to memory corruption, such as a heap-based buffer overflow or out-of-bounds write. Finally, the attacker leverages this corruption to overwrite critical function pointers, control structures, or execution flow, thereby achieving arbitrary code execution with the elevated privileges of the Windows Program Compatibility Assistant Service, which typically runs under a highly privileged system account."
}