Windows Broadcast DVR CVE-2026-108461

Requires the attacker to already have local, authenticated low-privilege execution on the target host (AV:L/PR:L) and to interact directly with the Windows Broadcast DVR User Service (the service implementing GameDVR/game-recording functionality) to trigger the use-after-free. Exploitation is further limited by a high-complexity race condition (AC:H) that must be won to control the freed object; no user interaction is required (UI:N). There is no remote or unauthenticated path - this is purely a local post-compromise escalation, so realistic risk is concentrated on shared or multi-user Windows hosts where an attacker can obtain an initial standard-user foothold.

This is a moderate-priority local privilege escalation. The provided CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 HIGH) is internally consistent with the description: AV:L and PR:L confirm the attacker must already have local, authenticated (low-privilege) code execution on the host, and AC:H reflects the race-condition nature typical of use-after-free (CWE-416) flaws, which must win a timing window to be reliably exploited. No EPSS score, SSVC decision, or KEV entry is present in the input, and there is no indication of public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict - they uniformly point to a non-wormable, post-compromise escalation rather than an internet-facing emergency. The main factor elevating real-world concern is prevalence (Windows) and the full C:H/I:H/A:H impact (SYSTEM-level compromise once exploited); the main factor limiting it is that AC:H plus PR:L means it is useful chiefly as a second-stage tool for an attacker who already has a foothold. Net: patch in normal cadence, prioritize on multi-user or shared hosts, but this is not a drop-everything network bug.

A low-privileged user (or malware already running under a standard user account) executes a crafted local process that interacts with the Windows Broadcast DVR User Service to trigger a use-after-free, repeatedly racing the service to win the timing window (AC:H). On success the freed object is reclaimed with attacker-controlled data, yielding code execution at SYSTEM and full control of the host. No public proof-of-concept is identified in the provided data.