A use‑after‑free flaw exists in the Windows Broadcast DVR User Service. The flaw allows an attacker with local access to manipulate freed memory and execute code with higher privileges, enabling elevation of privilege. The primary impact is that a local attacker can gain administrative or system level access to the affected Windows system.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019 (both standard and Server Core installations). These editions are listed as impacted by the CVE.

With a CVSS score of 7 the vulnerability is considered high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that there is no current evidence of widespread exploitation. The likely attack vector is local; an attacker must already have some form of authorized or local access to the machine to trigger the use‑after‑free. Should an attacker successfully exploit the flaw, they could gain complete control over the system, leading to full compromise of confidentiality, integrity, and availability.