Windows Broadcast DVR CVE-2026-102195

Requires the attacker to already have local, authenticated access to the target with at least low-level privileges (PR:L) - this is not remotely exploitable (AV:L) and cannot be reached over the network. The Broadcast DVR User Service (a default Windows component for Game DVR/broadcast capture) must be present and reachable by the user context, which is the default on Windows client editions. Exploitation is limited by high attack complexity (AC:H): the use-after-free likely depends on winning a race condition or precise heap grooming, so success is probabilistic rather than guaranteed, and no user interaction is involved (UI:N).

This is a local privilege-escalation use-after-free (CWE-416) in the Windows Broadcast DVR User Service, assessed at CVSS 7.0 (HIGH). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: AV:L confirms exploitation requires local access, PR:L indicates the attacker must already be an authenticated/authorized low-privileged user, and UI:N means no victim interaction is needed. The high complexity (AC:H) is characteristic of UAF bugs, which typically require winning a memory-lifecycle race or grooming the heap to land reliably - this materially lowers real-world exploitability versus a straightforward bug. Full C:H/I:H/A:H reflects the typical outcome of a successful service EoP: SYSTEM-level code execution. On exploitation signals, no EPSS score, no CISA KEV listing, and no public POC were provided in the input; combined with the local-only vector and high attack complexity, this points to a patch-on-normal-cycle priority rather than an emergency. It is a genuine privilege-escalation primitive valuable as the second stage of an intrusion chain, but there is no evidence of active exploitation or weaponization. Key missing data: EPSS probability is absent and POC status is unconfirmed, so the exploitation-likelihood dimension is based solely on the absence of KEV/POC signals.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) triggers a use-after-free in the Broadcast DVR User Service by manipulating object lifecycle timing, then grooms the freed allocation to gain control of execution flow and elevate to SYSTEM. Because AC:H reflects a race/heap-grooming requirement, reliable exploitation may take multiple attempts. No public exploit code was identified at time of analysis.