Windows Broadcast DVR CVE-2026-103567

Exploitation requires the attacker to already have local, authenticated access to a Windows host running the Broadcast DVR User Service (a default Windows component used by the Game DVR/broadcast feature), per the CVSS vector AV:L/PR:L/UI:N. No user interaction by a victim is needed, and no special non-default configuration is called out in the description. Limiting factors are significant: there is no remote attack surface, the attacker must hold at least low-privilege local credentials or code execution, and the impact is confined to reading memory (confidentiality only) - no write, code execution, or denial of service is possible.

This is a genuinely medium-severity, low-priority issue rather than an urgent one, and all signals agree. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5) makes clear the attacker must already have local, authenticated access to the host; there is no network vector and no path to code execution, integrity, or availability impact - only information disclosure (C:H). No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code is referenced, so exploitation probability cannot be quantified but no evidence of weaponization exists. No SSVC decision data was provided. The single technical impact is a buffer over-read (CWE-126) that leaks adjacent process memory, which could incidentally expose sensitive data (tokens, pointers useful for defeating ASLR) but requires a foothold on the machine first. In short: a real but low-priority local info-leak, useful mainly as a secondary step in a larger local attack chain, not a standalone remote threat. Note the 'Buffer Overflow' tag is imprecise - the CWE and description describe a buffer over-READ, not a classic overflow.

A locally authenticated low-privileged user (or malware already running under a standard user account) invokes the vulnerable Windows Broadcast DVR User Service in a way that triggers the out-of-bounds read, causing the service to return memory contents beyond the intended buffer. The leaked bytes may contain sensitive in-process data useful for escalating a broader local compromise. No public exploit code is referenced in the input, and exploitation requires existing local access, not remote reach.