This vulnerability is a use‑after‑free flaw located in the Windows Broadcast DVR User Service. An attacker who is authorized on the local system can trigger the flaw to elevate their privileges, potentially gaining administrative rights. The weakness is categorized as a use‑after‑free error (CWE-416), allowing the attacker to manipulate the program’s memory state.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. All processor architectures listed for these Windows versions are vulnerable.

The CVSS score of 7.8 classifies this issue as High severity. Exploitation requires a local, authorized user; the attacker must be logged into the system and have sufficient permissions to interact with the Broadcast DVR User Service. While the EPSS score is not available, the lack of listing in the CISA KEV catalog does not diminish the impact, as the flaw can lead to local privilege escalation in all affected builds.