The vulnerability is a use‑after‑free in the Windows Broadcast DVR User Service that lets an authorized local attacker raise their privileges. Because the service runs with elevated rights, the flaw is classified as CWE‑416 and can enable a compromised user to gain administrative capabilities.

Affected victims include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2019 installations, both standard and Server Core.

The CVSS score of 7 marks this as a high‑severity flaw, and the exploit requires local authorization. While EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the local privilege elevation potential makes patching a priority, especially on systems where privileged reset may be possible.