Windows Broadcast DVR EUVD-2026-100248

Exploitation requires pre-existing local access to the host as an authenticated user with at least low privileges (PR:L), plus the ability to run code or interact with the Windows Broadcast DVR User Service (bcastdvruserservice) to drive the use-after-free. The decisive limiting factor is the race condition (CWE-362, reflected as AC:H): the attacker must win a narrow, non-deterministic timing window between the object's free and reuse, so exploitation is unreliable and may need many attempts. No user interaction is required (UI:N) and no non-default configuration is needed - the service is present by default on affected Windows versions - but remote exploitation is not possible (AV:L).

This is a moderate-priority local privilege escalation. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated access with at least low privileges, and the high attack complexity (AC:H) reflects the CWE-362 race-condition nature of the use-after-free - exploitation depends on winning a non-deterministic timing window, which is not reliably repeatable. All three impact metrics are High (C:H/I:H/A:H, scope unchanged), consistent with SSVC's 'Technical Impact: total,' meaning a successful exploit yields full control of the affected service context (SYSTEM-level is typical for a Windows user service EoP). However, the risk-reducing signals dominate: CISA SSVC lists Exploitation as 'none' and Automatable as 'no,' no CISA KEV listing exists, and no public exploit was identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quoted. Net assessment: a genuine but second-tier patch priority - valuable to an attacker chaining from an existing foothold, but gated by local access, a race window, and no evidence of in-the-wild use. Note one metadata tension: the input Tags include 'Denial Of Service,' yet the description and CVSS describe privilege elevation with full CIA impact, not a pure availability/DoS issue - treat the DoS tag with caution.

An attacker who already has a low-privileged local account or code execution on a Windows host runs a crafted program that repeatedly triggers and races the Broadcast DVR User Service to hit the use-after-free window, corrupting freed memory to redirect execution. On success they elevate from a standard user to the service's privileged context. No public proof-of-concept was identified, and the high attack complexity means the race must be won, so exploitation is not guaranteed on each attempt.