CVE-2026-45487: Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Synopsis

A time-of-check time-of-use (TOCTOU) race condition is a class of bug where an attacker manipulates a shared resource in the window between when software checks a condition and when it acts on that result. This vulnerability exists in the Windows Program Compatibility Assistant Service across multiple Windows 10, Windows 11, and Windows Server 2022 versions. The attacker must already have a local session on the machine and a low-privilege account, but no network access or victim interaction is needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the affected host, effectively granting SYSTEM-level privileges. Patched-image rebuilds at the listed fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are needed to trigger the race condition.

• Victim interactionNot required

  The exploit runs entirely under the attacker's control with no need for another user to take any action.

• Attack complexityDetail

  Attack complexity is rated Low, but TOCTOU exploits do depend on winning a timing race; in practice the exploit can be attempted repeatedly until the race is won, making it reliably executable without special environmental setup.

Blast Radius

• The attacker reads any file or credential on the host, including secrets, tokens, and registry data accessible only to SYSTEM.
• The attacker writes or replaces arbitrary files and registry keys, enabling persistent backdoors or tampering with system binaries.
• The attacker terminates or crashes any process on the host, including security agents and critical services.
• Combined control of confidentiality, integrity, and availability means full host compromise from a low-privilege starting point.