Windows Broadcast DVR EUVD-2026-100384

Requires the attacker to already possess authenticated local access to the Windows host (PR:L) - this is a local privilege-escalation primitive, not a remote entry point, so it presupposes an existing low-privileged foothold. Exploitation targets the Windows Broadcast DVR User Service, present by default on Windows, so no special feature-enablement is indicated by the description. The principal limiting factor is the high attack complexity (AC:H): as a CWE-416 use-after-free, reliable exploitation requires winning a timing/race window and controlling heap reclamation, which reduces reliability and raises the skill bar. No user interaction is required (UI:N).

This is a locally-exploitable privilege-escalation flaw (CVSS 7.0, HIGH). The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N is internally consistent and signals genuinely constrained exploitation: the attacker must already have local, authenticated access (PR:L) and must overcome high attack complexity (AC:H), which for a CWE-416 use-after-free almost always means winning a race condition or achieving a specific memory-reclamation state - not a trivial one-shot. No EPSS score was provided; no CISA KEV listing is present; and no public proof-of-concept was supplied in the intelligence, so the exploitation status is 'no public exploit identified at time of analysis.' The high C:H/I:H/A:H impact (full SYSTEM compromise on success) is what drives the score up, but the real-world urgency is moderated by the local vector and high complexity. This is a solid 'patch in normal cadence' issue for most environments rather than a drop-everything emergency - it is not a high-CVSS-but-trivial remote bug, nor is it confirmed as actively exploited. Note a tag/impact conflict: the input tags include 'Denial Of Service,' yet the description and CVSS describe privilege elevation with full CIA impact - the DoS label appears mislabeled and should not drive prioritization.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-integrity process) runs code that interacts with the Broadcast DVR User Service to trigger a use-after-free, repeatedly attempting to win the race window. On success, the freed object is reclaimed with attacker-controlled data, yielding code execution in the service's SYSTEM context and full local privilege escalation. No public exploit code was identified in the provided intelligence, and the AC:H rating implies non-trivial reliability engineering is required.