Windows Broadcast DVR CVE-2026-88105

Exploitation requires the attacker to already have local access with low-level privileges (PR:L) on the affected Windows host - this is a local privilege-escalation primitive, not a remote entry point. The vulnerable component is the Windows Broadcast DVR User Service (bcastdvr), a per-user service present by default on Windows 10 and 11, so no non-default feature toggle appears necessary; the attacker must be able to reach/interact with that service to trigger the use-after-free. Limiting factors: no remote exploitation (AV:L), a pre-existing foothold and valid low-privilege context are needed, and the target must be running an unpatched build below the fixed versions listed in the EUVD data (e.g., <10.0.26100.9711 for 24H2). No user interaction is required (UI:N).

This is a locally-exploitable, authenticated privilege-escalation flaw (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, base 7.8) in the Windows Broadcast DVR User Service, with high confidentiality, integrity, and availability impact and an unchanged scope. The CVSS vector and CISA SSVC both agree on severity: SSVC rates Technical Impact as 'total', consistent with C:H/I:H/A:H and CWE-416 use-after-free memory corruption that typically enables SYSTEM-level code execution. However, the risk signals are consistently moderate, not critical: SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be independently confirmed. Because AV:L requires the attacker to already have local, low-privileged code execution on the host, this is a post-compromise escalation primitive rather than an initial-access or remotely-wormable bug - real priority for hardening endpoints and in defense-in-depth, but not an emergency drop-everything issue given the absence of active exploitation or a POC. The 'Denial Of Service' tag is somewhat at odds with a flaw described purely as privilege elevation; the A:H impact plausibly reflects memory-corruption-induced crashes, but the vendor describes EoP as the primary consequence - verify intended impact with Microsoft if DoS matters to your model.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a malicious app, or a compromised standard user account) triggers the use-after-free in the Broadcast DVR User Service to corrupt memory and execute code in a higher-privileged context, escalating to SYSTEM. No user interaction is required and attack complexity is low, but local access and some existing privileges are prerequisites. No public exploit code has been identified at time of analysis.