This vulnerability is a use-after-free flaw in the Windows Broadcast DVR User Service that permits a local, authorized attacker to gain elevated privileges. By freeing a memory object that the service still references, the attacker can influence subsequent service operations, potentially executing arbitrary code with higher privileges. The adverse effect is the loss of confidentiality, integrity, and local isolation safeguards, allowing the attacker to install software, change settings, or access restricted data on the affected system.

Microsoft Windows 11 release 23H2, 24H2, 25H2, 26H2, 26H1 across both x64 and arm64 platforms. The versions specified in the CNA include Windows 11 version 23H2 through 26H2 for x64 and arm64 architectures, and Windows 11 version 26H1 for arm64.

The reported CVSS base score is 7, indicating moderate to high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not yet listed in CISA’s KEV catalog. The flaw requires local user privileges and the attacker must be able to invoke the faulty Broadcast DVR User Service; thus the attack vector is local. Because the vulnerability is a classic use-after-free, once the flaw exists the attacker can craft an exploit that runs with elevated local privileges, raising the risk for any user on the affected machine.