Microsoft Windows CVE-2026-85938

Exploitation requires local access to the affected Windows host plus low-level authenticated privileges (PR:L), and specifically the ability to interact with the Windows Broadcast DVR User Service (the per-user service, typically BcastDVRUserService, associated with Game DVR/broadcast capture). No user interaction is needed (UI:N). The vulnerability is not remotely reachable (AV:L) and cannot be triggered against a default configuration from the network, which substantially limits exploitation to attackers who already have a foothold on the machine; the impact is confined to disclosure of information the attacker is not authorized to read (C:H only, no integrity or availability impact).

This is a moderate, low-priority issue despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a locally-exploitable information-disclosure flaw: the attacker must already have local access and at least low-level (authenticated) privileges on the host, and the only impact is high confidentiality loss with no integrity or availability impact. All exploitation signals align toward low real-world urgency and reinforce each other rather than conflicting: SSVC reports Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local, privilege-requiring vector that cannot be sprayed at scale), and Technical Impact=partial (consistent with a confidentiality-only, scope-unchanged flaw). There is no CISA KEV listing and no public POC, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in. The one notable inconsistency is in the metadata: the CVE is tagged 'Authentication Bypass,' but the CWE (CWE-862, Missing Authorization) and the description (improper access control enabling local information disclosure) describe an authorization/access-control failure, not an authentication bypass - the tag appears mislabeled and should not drive triage. Net: a genuine but low-severity local info-disclosure bug that should be patched in routine cycles, not treated as an emergency.

An attacker who has already gained low-privileged authenticated access to a Windows host (e.g., a standard local user or a foothold from phishing/malware) abuses improper access control in the Broadcast DVR User Service to read information they should not be authorized to access. There is no public exploit identified at time of analysis, and the local attack vector with required privileges means this is a post-compromise escalation/disclosure step rather than an initial remote entry point.