Windows Broadcast DVR CVE-2026-97807

Requires the attacker to already have local, authenticated access to the target host as a low-privileged user (CVSS PR:L) and the ability to run code that interacts with the Windows Broadcast DVR User Service (bcastdvr / BcastDVRUserService), the component containing the use-after-free. No user interaction is needed (UI:N) and no non-default configuration is called out - the service ships enabled on standard Windows 10, 11 and Server 2019 installations within the affected build ranges listed in EUVD. The principal limiting factor is the local vector (AV:L): there is no network-exploitable path, so the attacker must first achieve a foothold on the machine. Hosts where untrusted users cannot obtain local sessions (e.g., single-admin workstations with no untrusted code execution) face substantially lower realistic risk.

This is a credible but not emergency-tier priority. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a local attacker (AV:L) who is already authenticated with low privileges (PR:L) can exploit a use-after-free (CWE-416) in the Windows Broadcast DVR User Service to gain high confidentiality, integrity and availability impact - classic local elevation of privilege. There is no CISA KEV listing and no public exploit referenced in the supplied data, so exploitation status is 'no public exploit identified at time of analysis'; this is NOT active in-the-wild exploitation. No EPSS score was provided and no SSVC decision data is present, so probabilistic exploitation signals cannot be evaluated - this is a gap. Because the flaw requires prior local, authenticated code execution and the scope is unchanged (S:U), real-world risk is meaningful primarily as a post-compromise escalation step (e.g., chaining from a low-privilege foothold to SYSTEM) rather than as an initial, remotely exploitable breach. One minor signal conflict: the input Tags include 'Denial Of Service' while the description and CVSS (C:H/I:H/A:H) frame this as privilege elevation; a UAF can plausibly cause both, so this is not necessarily an error, but the primary documented impact is EoP, not DoS. Priority: patch promptly on multi-user, shared, or exposed Windows hosts, but it does not warrant the same urgency as a remote unauthenticated or actively-exploited bug.

An attacker who already has a low-privileged authenticated session on a Windows host (for example via phishing, a compromised standard user account, or an initial-access exploit) runs a crafted local program that manipulates the Broadcast DVR User Service to trigger the use-after-free. By controlling the freed-then-reused memory, the attacker executes code in the service's higher-privilege context, escalating to SYSTEM-level control. No public proof-of-concept is referenced in the provided data, and the low attack complexity (AC:L) means a reliable exploit, if developed, would not require winning difficult races.