The vulnerability is a use‑after‑free in the Windows Broadcast DVR User Service. A local attacker who can influence the service can trigger a memory error that causes the service to execute code with higher privileges. This flaw is identified as CWE‑416 and can allow an authenticated user to obtain full control over the affected system.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicated), and 26H1; Microsoft Windows Server 2019, including Server Core installations.

The CVSS score of 7 indicates a medium severity set by Microsoft. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known active exploitation. The flaw requires a local attacker with sufficient permission to supply data to the Broadcast DVR User Service and leverage the use‑after‑free. It is therefore not remotely exploitable but poses a significant risk to systems where an attacker could interact with the service or coercer user processes.