Windows Broadcast DVR EUVD-2026-100352

Exploitation requires the attacker to already possess local, low-privileged authenticated access to the target Windows system (PR:L, AV:L) - this is a local elevation-of-privilege flaw, not remotely reachable. The specific prerequisite is the ability to interact with the Windows Broadcast DVR User Service (BcastDVRUserService) and trigger the use-after-free condition. The key limiting factor is high attack complexity (AC:H): the use-after-free requires winning a race or meeting timing/heap-state conditions that are not guaranteed on each attempt, reducing reliability. No user interaction is required once local access is obtained (UI:N).

This is a legitimately serious local privilege-escalation flaw but not an emergency. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) tells a consistent story: an attacker must already have local code execution with low privileges (PR:L) and must win a non-trivial race or satisfy timing conditions typical of use-after-free bugs (AC:H), but success yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - i.e., SYSTEM-level elevation. No EPSS score was provided, and there is no CISA KEV listing and no public proof-of-concept in the supplied data, so exploitation is currently theoretical. The high attack complexity (AC:H) is a meaningful dampener: UAF-based elevation in Windows user services is exploitable but usually requires reliable heap/race manipulation, which raises the bar for mass exploitation. Net priority is moderate - this belongs in the normal Patch Tuesday cycle as a second-stage EoP primitive rather than a drop-everything item, unless it later appears in KEV. One caveat: the input Tags include 'Denial Of Service,' which conflicts with the description and CVSS (which describe privilege elevation with full impact, not merely availability loss) - treat the DoS tag with skepticism.

An attacker who has already gained low-privileged code execution on a Windows host (via phishing payload, a compromised standard user account, or another foothold) triggers the use-after-free in the Broadcast DVR User Service by manipulating object lifecycle/timing, then leverages the freed-object reuse to execute code at SYSTEM privilege. No public exploit code is identified at time of analysis, and the high attack complexity means a working exploit must reliably win the underlying race or heap condition.