Windows Broadcast DVR CVE-2026-88103

Requires the attacker to already have authenticated low-privileged local access to the Windows host (AV:L, PR:L) and to successfully win a race condition against the Broadcast DVR User Service to trigger the use-after-free (AC:H), with no user interaction needed (UI:N). The vulnerable service is part of the Windows Game/Broadcast DVR functionality present by default on affected Windows 10, Windows 11 (21H2-26H2), and Windows Server 2019/1809 builds below the patched versions listed in EUVD. Limiting factors: no remote network vector, prior local foothold needed, high timing-dependent complexity, and availability of a vendor patch all reduce realistic exploitation likelihood.

Signals are consistent and point to a genuine but non-urgent High-severity issue rather than a top-priority emergency. The CVSS 3.1 base of 7.0 is driven by total technical impact (C:H/I:H/A:H) but tempered by a restrictive exploitability profile: AV:L requires local presence, AC:H reflects a timing/race condition typical of use-after-free, and PR:L means the attacker must already be an authenticated low-privileged local user (UI:N, scope unchanged). CISA SSVC reinforces lower urgency - Exploitation: none, Automatable: no - while still rating Technical Impact as total, which matches the C:H/I:H/A:H vector. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed in-the-wild activity. Net: a real, patchable local elevation-of-privilege flaw worth remediating in a normal patch cycle, not a drop-everything issue. Note a metadata inconsistency: the input Tags include 'Denial Of Service', but the description and CVSS (full confidentiality/integrity/availability impact via privilege elevation) characterize this as an elevation-of-privilege flaw, not primarily a DoS - treat the DoS tag with caution.

A low-privileged user who already has local access to a Windows machine runs a crafted program that repeatedly interacts with the Broadcast DVR User Service to win a race condition and trigger the use-after-free, reclaiming the freed object with attacker-controlled data to run code at a higher privilege level (up to SYSTEM). No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires winning a memory-timing race.