The vulnerability is a use‑after‑free bug in the Windows Broadcast DVR User Service that enables a local user who has authorization on the system to gain higher privileges. The flaw occurs when a process continues to reference a buffer after the service releases it, allowing the attacker to craft interactions that result in privilege escalation. The weakness is identified as CWE‑416.

Microsoft Windows 10 versions 1809, 21H2, and 22H2, as well as Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 are affected. The vulnerability resides in the Windows Broadcast DVR User Service component, which operates under the local user context.

With a CVSS score of 7, the flaw is considered high‑severity for local privilege escalation. An EPSS score is not available, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation campaigns. Exploitation requires a local user already authorized to execute code, so the risk is higher in environments where privileged local accounts are compromised or least‑privilege controls are weak.