Windows Broadcast DVR CVE-2026-103554

Requires the attacker to already hold valid low-privileged local access to the target Windows machine (PR:L, AV:L) and to interact with the Broadcast DVR User Service (BcastDVRUserService), the Game-DVR/broadcast component present by default on Windows 10/11. Exploitation is limited by high attack complexity (AC:H): the use-after-free must be triggered under a specific memory-reuse/race condition, so success is not guaranteed on each attempt. No user interaction is needed (UI:N), and no remote/network path exists - this cannot be exploited by an unauthenticated or remote attacker.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) establishes that an attacker must already have local, low-privileged code execution on the host (PR:L) and must win a non-trivial condition - AC:H is characteristic of use-after-free (CWE-416) flaws that depend on a race or specific memory-timing window - to achieve full confidentiality, integrity, and availability compromise within the same security authority (S:U). The description's phrase 'authorized attacker ... locally' is consistent with the PR:L/AV:L vector. No EPSS score, no SSVC decision, no CISA KEV entry, and no public POC were provided, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS-vs-description conflict), but the high attack complexity and local-only vector make this a credible second-stage EoP for an attacker who already has a foothold rather than an initial-access or widespread-exploitation threat. Note the provided 'Denial Of Service' tag conflicts with the C:H/I:H/A:H full-impact EoP described - treat the tag with caution; the authoritative impact per description and CVSS is privilege elevation.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) triggers a race condition in the Broadcast DVR User Service to reuse freed memory, corrupting service state to run code at elevated privilege. No public exploit code is known, and the high complexity (AC:H) means the attacker must reliably win a memory-timing window to succeed.