The vulnerability is a use‑after‑free flaw within the Windows Broadcast DVR User Service that can be exploited by an authorized local user to gain elevated privileges. By freeing memory that is still referenced, an attacker can manipulate execution flow to perform actions with higher permissions. The weakness is classified as CWE‑416 and results in a local privilege escalation that could be leveraged to run arbitrary code, change system settings, or access sensitive data.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2019 (including Server Core installations). The affected builds support x86, x64, and Arm64 architectures according to the listed identifiers.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw requires an authorized local user or a user who can trigger the Broadcast DVR service, the attack vector is likely local. Exploitation would allow the attacker to raise their privileges to that of the service process, enabling full control over the affected system.