A use‑after‑free flaw in the Broadcast DVR component lets an attacker with legitimate local access run code with higher privileges, bypassing normal security controls and potentially compromising the affected system. The vulnerability enables privilege escalation by exploiting memory corruption after an object has been freed and reallocated. The impact is confined to local accounts; no remote or network injection is required.

Microsoft Windows 10 versions 1809, 21H2, and 22H2, and Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1 are all affected. The flaw affects all supported architectures, including x86, x64, and ARM64.

The CVSS score of 7 indicates a high severity, but the EPSS probability is reported as less than 1% and the flaw is not included in the CISA Known Exploited Vulnerabilities catalog. The attack requires a locally‑authenticated user to invoke the Broadcast DVR service, so exploitation is unlikely to succeed without such access. No widespread exploitation is currently documented, yet the vulnerability remains a serious concern for systems that allow unrestricted local users to interact with the DVR component.