Windows Broadcast DVR CVE-2026-97809

Requires a local, authenticated foothold on the target Windows host (PR:L) with the ability to interact with the Broadcast DVR User Service, which ships and runs by default across the affected Windows 10, Windows 11, and Windows Server builds - no special non-default configuration is indicated by the description. Exploitation is strictly local (AV:L): there is no remote or network-facing vector, and the attacker must already be able to execute code at low privilege on the machine, which is the primary limiting factor. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained there are no additional timing or configuration barriers described.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already hold a low-privileged, authenticated foothold on the host (PR:L), but once there, attack complexity is low (AC:L), no user interaction is needed, and the impact is full compromise of confidentiality, integrity and availability - consistent with CWE-416 use-after-free leading to code execution in a privileged service context. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified from the data and there is no public exploit identified at time of analysis. The signals are therefore internally consistent (a vendor-reported local EoP with a patch) rather than conflicting; the main caveat is that EoP bugs like this are typically chained behind an initial-access vulnerability and are commonly weaponized post-disclosure for the final SYSTEM-escalation step, so despite the 'local-only' vector the real-world priority is elevated for any multi-user or internet-facing Windows host. Treat as a standard-high patch priority within normal Patch Tuesday cycles, prioritized higher on shared/terminal-server systems.

An attacker who has already gained a low-privileged session on a Windows host (via phishing, a compromised service account, or a separate remote bug) locally invokes the Broadcast DVR User Service and triggers the use-after-free by manipulating object lifetime, reclaiming the freed allocation with attacker-controlled data to hijack execution flow and run code at the service's elevated privilege level. No user interaction is required and attack complexity is low (AC:L); no public exploit code has been identified at time of analysis.