Windows Broadcast DVR CVE-2026-70122

Exploitation requires the attacker to already have a local, authenticated low-privileged session on the host (CVSS PR:L) and the ability to run code that interacts with the Windows Broadcast DVR User Service (bcastdvruserservice). Because the flaw is a TOCTOU race (CWE-367), the attacker must reliably win a narrow timing window between the service's validation and use of a resource - a non-trivial, repeatable-attempt condition reflected by SSVC Automatable=no. No network vector, no user interaction, and no confidentiality precondition apply; the limiting factors are the need for prior local access, the race-timing reliability, and that the target must be an unpatched Windows 10 (21H2/22H2) or Windows 11 (23H2/24H2/25H2/26H1/26H2) build below the fixed versions listed by EUVD.

This is a locally-exploitable elevation-of-privilege flaw, not an internet-facing one: the provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, base 6.5 Medium) requires the attacker to already be a low-privileged authenticated user on the host. Multiple signals agree that this is NOT an urgent, widely-exploited priority: CISA's SSVC framework records Exploitation=none and Automatable=no, there is no CISA KEV listing, no EPSS score was supplied, and no public exploit is referenced - yet SSVC Technical Impact=total and the Scope:Changed / Integrity:High metrics indicate that successful exploitation yields full control over the compromised component's security boundary (consistent with SYSTEM-level privilege gain). The signals are therefore internally consistent (low real-world exploitation pressure, high per-instance impact) with one caveat: the Microsoft 'Information Disclosure' tag conflicts with the CVSS vector, which sets C:N (no confidentiality impact) and I:H - this is an integrity/privilege-elevation bug, not information disclosure, so the tag should not drive triage. The absence of an EPSS score means statistical exploitation likelihood could not be weighed; given Automatable=no and the TOCTOU timing requirement, opportunistic mass exploitation is unlikely, but the ubiquity of Windows makes this worth patching on the vendor's normal cadence.

A low-privileged user who already has code execution on a Windows host (e.g., via a standard user account or a sandboxed/malware foothold) runs a program that repeatedly triggers the Broadcast DVR User Service and wins a time-of-check/time-of-use race to manipulate a resource between validation and use, causing the service to perform a privileged action on the attacker's behalf. No public exploit is identified at time of analysis, and the attack needs no user interaction but does require local access and winning the race window.