Windows Broadcast DVR EUVD-2026-100090

Exploitation requires the attacker to already possess local, authenticated low-privilege access to the target host (CVSS PR:L, AV:L) - this is a post-compromise privilege-escalation primitive, not a remote entry point. The flaw lives in the Windows Broadcast DVR User Service (the bcastdvr/Game DVR capture component present by default in Windows 10 and 11), so no special feature toggle is needed, but successful exploitation is LIMITED by High attack complexity (AC:H): the use-after-free is a race/timing-dependent condition that the attacker must reliably win to reclaim freed memory, and SSVC rates it 'Automatable: no.' No user interaction is required (UI:N). Defenders should note that the primary mitigating factor is the mandatory pre-existing local foothold plus the non-deterministic timing window, not any uncommon configuration.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Broadcast DVR User Service enabling privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) and the 7.0 'High' base score together describe a meaningful but non-trivial-to-exploit flaw: the attacker must already have local, low-privilege code execution on the host (PR:L, AV:L) and must win a race or satisfy specific timing/heap conditions typical of UAF bugs (AC:H). All three impacts are High (C:H/I:H/A:H), consistent with full privilege elevation, which aligns with the SSVC 'Technical Impact: total' rating. Crucially, the signals point toward low urgency: SSVC reports Exploitation 'none' and Automatable 'no', no CISA KEV listing and no public POC are present in the input, so this is currently a no public exploit identified at time of analysis situation. The 'Automatable: no' and AC:H values reinforce that this is not a spray-and-pray or wormable bug - it requires a pre-existing foothold and favorable conditions. Net: a genuinely patch-worthy EoP primitive useful as a second-stage in a post-exploitation chain, but NOT an emergency given no evidence of exploitation and non-trivial attack complexity. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in - this is a data gap rather than a low-risk confirmation.

An attacker who has already achieved low-privileged local code execution (e.g., via a phishing-delivered user-mode malware payload or a compromised standard user account) triggers the use-after-free in the Broadcast DVR User Service by manipulating service object lifetimes. By winning the resulting race condition, they reclaim the freed memory with attacker-controlled data to redirect execution and elevate to SYSTEM-level privileges. No public proof-of-concept is identified in the provided data, and the High attack complexity means reliable exploitation requires precise timing.