Windows Broadcast DVR EUVD-2026-100348

Exploitation requires the attacker to already hold low-privileged authenticated local access to the target Windows system (PR:L, AV:L) - there is no remote or network-facing attack path. The attacker must interact with the Windows Broadcast DVR User Service (the Windows feature that records/streams game and broadcast DVR content) to trigger the use-after-free. Exploitation is limited by high attack complexity (AC:H), which for a UAF of this type indicates a race condition or precise heap state that the attacker does not fully control and must win reliably; no user interaction is required (UI:N). The flaw affects the service as shipped, so no special non-default configuration is named in the available data, but the service must be present/running on the host.

This is a genuine but second-tier priority. The CVSS 3.1 base score is 7.0 (High), reflecting high confidentiality, integrity, and availability impact (C:H/I:H/A:H) but constrained by a local attack vector (AV:L), high attack complexity (AC:H), and a requirement for low-level privileges (PR:L). The high complexity is significant: use-after-free exploitation on Windows services typically requires winning a race condition or precise heap grooming, which raises the bar for reliable exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept was referenced, so there is no public exploit identified at time of analysis. The only reference is the Microsoft MSRC advisory. This profile - local EoP requiring existing authenticated access plus a hard-to-win race - makes it a post-compromise privilege-escalation building block rather than an initial-access or wormable threat; patch it on the normal Patch Tuesday cycle with priority on multi-user and shared workstation systems. Note a tag/description conflict: the vulnerability is tagged 'Denial Of Service' but the description and CVSS (C:H/I:H/A:H) describe privilege elevation, not merely DoS - treat the DoS tag with caution.

A local, authenticated attacker who already has low-privileged access to a Windows host (e.g., a standard user account or a compromised low-privilege process) triggers a use-after-free condition in the Broadcast DVR User Service by manipulating the timing of service object allocation and release. By grooming the heap to reclaim the freed object, the attacker gains code execution in the context of the service to elevate to higher privileges. No public exploit is identified at this time, and the high attack complexity (AC:H) means exploitation likely depends on winning a race condition.