Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should assess whether the Windows Program Compatibility Assistant Service is present in their estate and review associated security configurations.
Questions to ask IT
- Are we affected by CVE-2026-88247, and which of our systems would be?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
- The vulnerability involves the use of an uninitialised resource in the
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- A vulnerability in the Windows Program Compatibility Assistant Service could allow an authorised attacker to disclose local information due to an uninitialised resource.
Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)
Part of Multiple Windows and SQL Server Information Disclosure Vulnerabilities
Pulse
Last change 58m ago · Next recheck 11 Nov 2026, 19:04 UK time
- Story10 Nov 2026, 19:04 UK time · 58m ago
Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).
Read source (Microsoft Security Update Guide RSS)
1 entry so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-88247 Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
- ProbableSummary fact75% confidence
Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorised attacker to disclose information locally.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-88247