Windows Broadcast DVR CVE-2026-69735

Exploitation requires an existing local session with at minimum standard (non-elevated) user privileges on the target Windows host - PR:L in the CVSS vector confirms this. The Windows Broadcast DVR User Service must be running on the target system; this service is present in default Windows 10 and Windows 11 consumer installations but may not be enabled on stripped-down Server Core configurations. The AC:H rating indicates that exploitation is non-trivial and likely requires timing control or heap-shaping techniques, limiting fully reliable exploitation to skilled attackers. Remote unauthenticated exploitation is not possible - an initial foothold on the system is a hard prerequisite. Windows Server environments with the Broadcast DVR User Service disabled or not installed are not affected.

The CVSS 7.0 base score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately frames this as a meaningful but constrained threat. An attacker must already hold a local interactive or remote-shell session with at least standard user privileges before this vulnerability can be leveraged, which limits the attack surface to post-exploitation or insider-threat scenarios rather than direct internet exposure. The AC:H rating signals that reliable exploitation is non-trivial, requiring precise timing or heap-state manipulation. No CISA KEV listing and no public POC are present in the input data, consistent with a vulnerability disclosed alongside a patch and not yet weaponized in observed campaigns. Despite these constraints, local LPE bugs in Windows services are high-value primitives for ransomware operators and nation-state actors who pivot from low-privileged footholds; the broad version-range coverage across consumer and server Windows editions increases the probability that a vulnerable host will be encountered in any enterprise network.

An attacker who has gained a standard user shell on a target Windows host - via phishing, credential stuffing, or lateral movement - sends a crafted sequence of requests to the Broadcast DVR User Service that triggers a race condition, freeing a service-internal object while a concurrent operation still holds a reference to it. By winning the race and reclaiming the freed heap allocation with attacker-controlled data, the attacker redirects execution flow within the service to run arbitrary code at elevated privilege, achieving SYSTEM-level access. No public exploit code has been identified, making this scenario contingent on private exploit development at time of analysis.