Windows Broadcast DVR CVE-2026-97808

Exploitation requires the attacker to already be a locally authenticated, low-privileged principal on the host (AV:L, PR:L) and to interact with the Windows Broadcast DVR User Service (the gaming/Game DVR broadcast capture service) to trigger the use-after-free. The high attack complexity (AC:H) reflects a required win of a memory-lifecycle race/timing window and successful heap grooming to reclaim the freed object, which materially limits reliable exploitation. No user interaction is needed (UI:N), but exploitation is bounded by the need for pre-existing local access and the non-deterministic UAF condition; it is not remotely reachable and cannot be triggered by an unauthenticated attacker. Affected deployments are Windows 10 (1809-22H2), Windows 11 (23H2-26H2 including 26H1), and Windows Server 2019 below the fixed builds listed in EUVD.

This is a local, authenticated privilege-escalation flaw (CVSS 3.1 7.0, HIGH) in the Windows Broadcast DVR User Service, driven by a use-after-free (CWE-416). The CVSS vector signals point in a consistent direction toward moderate-but-not-urgent risk: AV:L requires local access, PR:L requires the attacker to already have a low-privileged foothold, and AC:H indicates a non-trivial condition (typical of UAF race/timing windows) that must be won for reliable exploitation. Against that, the impact is maximal (C:H/I:H/A:H) because success yields elevated privileges on the host. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not a drop-everything issue. It is a post-compromise escalation primitive rather than an initial-access or wormable bug. The 'Denial Of Service' tag partially conflicts with the description, which frames the outcome as privilege elevation (EoP), not DoS; the A:H metric means availability loss is plausible as a secondary effect, so treat DoS as a possible side effect, not the primary impact. Overall priority: patch in the normal monthly cycle, prioritizing multi-user, shared, and terminal/RDP hosts where low-privileged users coexist with higher-value accounts.

A low-privileged user who already has code execution on a Windows host (via a logged-in session, a malicious local app, or a compromised service account) runs a crafted program that interacts with the Broadcast DVR User Service to trigger the use-after-free. By winning the timing/race condition (AC:H) and grooming freed memory, the attacker corrupts an object to execute code at a higher privilege level, escalating to SYSTEM. No public exploit was identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.