A use‑after‑free bug in the Windows Broadcast DVR User Service allows an attacker who already has local user access to gain elevated privileges on the machine. The flaw exploits memory corruption (CWE‑416), potentially enabling the attacker to run privileged code or access sensitive system resources. As a local elevation of privilege vulnerability, it can lead to full system compromise if the attacker later leverages other weaknesses.

Microsoft Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2019 including Server Core installations are affected. The vulnerability spans multiple architecture variants, including x86, x64, and ARM64 platforms.

The CVSS score is 7, indicating a high severity vulnerability, but no EPSS score is available and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is local; an attacker needs legitimate user access to the target system. Exploitation requires triggering the use‑after‑free condition in the Broadcast DVR User Service, which could be achieved through crafted input or abuse of existing functionality. Given the high CVSS and potential for complete system takeover, the risk to affected systems is significant.