Windows Broadcast DVR CVE-2026-70148

Exploitation requires the attacker to already have LOCAL, authenticated access to the Windows host with at least low-level user privileges (CVSS PR:L, AV:L) - it cannot be performed remotely or by an unauthenticated actor. The specific prerequisite is the presence and reachability of the Broadcast DVR User Service (bcastdvr / Game DVR-related broadcast service), which runs by default on affected Windows 10, Windows 11, and Windows Server 2019 builds. No user interaction is needed (UI:N), and the complexity is low (AC:L). The principal limiting factor is the need for an existing local foothold; this is not exploitable across the network and does not grant code execution or modification - impact is confined to disclosure of confidential information (C:H, I:N, A:N).

This is a moderate-severity local information disclosure flaw (CVSS 6.5) in the Windows Broadcast DVR User Service, and the available signals are largely consistent in pointing to a LOWER real-world priority than the 'High' C:H impact alone might suggest. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) requires LOCAL access and LOW privileges (an authenticated user already on the machine), with no availability or integrity impact - the inflation to 6.5 comes primarily from the scope change (S:C), meaning the disclosed confidential data crosses a security boundary. The CISA SSVC framework corroborates low urgency: Exploitation=none (no observed or proof-of-concept exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with the local vector and privilege requirement), and Technical Impact=partial. There is no CISA KEV listing and no POC reported, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not evidence of either high or low likelihood. The signals do not conflict: a local, authenticated, information-only vulnerability with no observed exploitation is a routine patch-cycle item rather than an emergency, despite the ubiquity of the affected Windows platform.

An attacker who already has low-privileged authenticated access to a Windows host (for example, a standard local user or a foothold gained through another vector) interacts with the Broadcast DVR User Service to trigger the improper authorization flaw and read confidential information belonging to another security scope on the same machine. No remote access, no user interaction, and no elevated privileges are required beyond the initial local logon. No public proof-of-concept exploit code has been identified at the time of analysis.