Windows Broadcast DVR CVE-2026-105722

Exploitation requires the attacker to already have local, authenticated access with low-level privileges (PR:L, AV:L) on a Windows system where the Broadcast DVR User Service is running - this service is present by default on standard Windows desktop/client installations. The key limiting factor is the high attack complexity (AC:H): because this is a use-after-free, successful exploitation depends on winning a memory-timing race condition, which makes reliable exploitation difficult and typically requires multiple attempts. No user interaction is needed (UI:N), and no special non-default configuration is indicated by the description.

This is a locally-exploitable elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows Broadcast DVR User Service, carrying a CVSS 3.1 base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a moderate-priority issue rather than an emergency: the attack vector is local (AV:L) and requires an attacker to already hold low-level privileges (PR:L), and the high attack complexity (AC:H) - typical of a use-after-free race condition that must win a timing window - further dampens real-world exploitability despite the high confidentiality/integrity/availability impact once triggered. No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from available signals. There is no conflict between the CVSS vector and the description - both describe local, authorized (authenticated) privilege escalation. Treat this as a standard patch-cycle item for Windows endpoints rather than a drop-everything priority, barring any future KEV/exploit development.

A low-privileged user who already has code execution on a Windows machine (for example via a standard user account or a sandboxed process) runs a crafted program that races the Broadcast DVR User Service to trigger the use-after-free. By grooming the freed memory and winning the timing window, the attacker corrupts memory to execute code in the service's higher-privilege context, escalating from a normal user to elevated privileges. No public exploit identified at time of analysis, and the high attack complexity means reliable exploitation requires winning a race condition.