Windows Broadcast DVR CVE-2026-102196

Exploitation requires the attacker to already have authenticated, low-privileged local access to the Windows machine (CVSS PR:L, AV:L) and the ability to interact with the Broadcast DVR User Service (bcastdvruserservice), which is a default component of Windows client installations. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning the use-after-free can be triggered reliably once local access exists. The key limiting factor is the local-only vector: this cannot be exploited remotely or by an unauthenticated actor, so it functions as a post-access escalation step rather than an initial-access vulnerability. Realistic risk is highest on multi-user systems or where an attacker has already achieved standard-user code execution.

This is a credible, actionable local privilege-escalation issue rather than a high-CVSS-but-low-real-risk artifact, though it is not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable use-after-free (CWE-416) that requires an attacker to already hold low-privilege authenticated access to the target host, with low attack complexity and no user interaction, yielding full confidentiality/integrity/availability impact within the same security scope (elevation to SYSTEM-level service context). Critically, several real-world-risk signals are absent from the provided data: there is no EPSS score, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore that of a post-compromise escalation primitive (useful after phishing, malware execution, or a chained remote bug), not an internet-facing mass-exploitation threat. One data caveat: the input Tags include 'Denial Of Service,' which is inconsistent with the full C:H/I:H/A:H elevation-of-privilege impact Microsoft assigned - the availability impact of a UAF can manifest as a crash, but the primary vendor-stated impact is privilege elevation, so treat the DoS framing as secondary. The only reference is the Microsoft MSRC advisory; affected build numbers and a confirmed patch version are not included in the provided data and must be retrieved from MSRC/Patch Tuesday guidance.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via a phishing payload or a standard user account) locally triggers the use-after-free in the Broadcast DVR User Service to corrupt memory and hijack execution in the service's higher-privileged context, elevating to SYSTEM. No user interaction and only low attack complexity are required once local access is obtained. No public proof-of-concept exploit is referenced in the available data.