Use after free in Windows Broadcast DVR User Service can be triggered by an authorized user to gain elevated local privileges. The flaw arises when a freed memory reference is later accessed, allowing the attacker to execute code with higher privileges than previously granted. This can lead to full control over the machine, enabling the installation of malware, data exfiltration, and persistence. The vulnerability is a classic use‑after‑free flaw, identified as CWE‑416.

The flaw affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019, including Server Core installations.

The CVSS score of 7.8 indicates moderate to high severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring the attacker to be authenticated or otherwise authorized on the host. Because the flaw is an elevation of privilege, an attacker with limited user rights can potentially compromise the system without needing remote access.