Windows Broadcast DVR EUVD-2026-100408

Exploitation requires the attacker to already hold authenticated low-privilege local access to the Windows host (CVSS PR:L, AV:L) and the ability to interact with the Broadcast DVR User Service (bcastdvruserservice), which is present by default on Windows 10, Windows 11 and the listed Windows Server builds; the use-after-free is triggered by a locally running process, needs no user interaction (UI:N) and no special non-default configuration. The principal limiting factor is the local-access and prior-authentication prerequisite: a remote, unauthenticated attacker cannot exploit this directly, so it functions as a second-stage escalation after an initial foothold. Unpatched systems are those below the fixed builds (e.g. Windows 11 24H2/25H2/26H1/26H2 below 10.0.26100.9711 / 26200.9711 / 28000.3231 / 26300.9711, Windows 10 22H2/21H2 below 10.0.19044.7807, and Windows Server 2019 / Windows 10 1809 below 10.0.17763.9376).

All signals point to a credible but not emergency-grade local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms local exploitability, low attack complexity, a requirement for low existing privileges (an authenticated standard user), no user interaction, and full confidentiality/integrity/availability impact. Because the attack vector is local and requires prior low-privilege access (PR:L), this is a post-compromise escalation primitive rather than a remote entry point. No EPSS score, CISA KEV listing, public POC, or SSVC decision data was provided in the input, so exploitation probability and in-the-wild activity cannot be quantified; exploitation status is therefore 'no public exploit identified at time of analysis.' The most actionable tension is the 'Denial Of Service' tag versus the description and vector: the description describes privilege elevation and the vector shows C:H/I:H/A:H (code-execution-grade impact), so DoS is at best a secondary consequence of the use-after-free, not the primary risk - treat this as an EoP, not a DoS. Given the ubiquitous Windows install base and Microsoft-grade memory-corruption EoP flaws being a historically favored second-stage technique, patch prioritization should be high even without KEV/EPSS confirmation.

An attacker who already has low-privileged code execution on a Windows host (for example via phishing, a malicious app, or a compromised standard user account) runs a crafted program that triggers the use-after-free in the Broadcast DVR User Service to corrupt memory and elevate to SYSTEM. No public exploit code was identified at time of analysis, and because the CVSS vector is AV:L the attacker must already be local; no user interaction is required (UI:N).