A use‑after‑free defect in the Windows Broadcast DVR User Service allows a user who already has authorization on the affected system to raise privileges. Exploiting this flaw can give an attacker SYSTEM‑level access, allowing full control over the machine. The weakness is a classic use‑after‑free issue, classified as CWE‑416, where the service accesses memory that has already been deallocated, leading to unpredictable behavior that can be leveraged to write or execute code with elevated rights.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2 through 26H2 (including arm64 and x64 builds) and Windows Server 2019, both standard and Server Core images. Users running these operating systems are exposed if the Broadcast DVR User Service is installed and running.

The CVSS score of 7.0 indicates a high severity local threat. EPSS data is not available, and the weakness is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. However, because the flaw requires only local privileges and can be triggered by any authenticated user, the potential impact is significant for environments where privileged application execution is permitted. The attack is likely to be performed from a legitimate user account, making detection of the initial privilege escalation difficult without monitoring for unusual service behavior.