The vulnerability is a use‑after‑free condition in Windows Broadcast DVR User Service. An authorized local user can trigger the flaw and gain elevated privileges, potentially allowing the attacker to move from a restricted user context to a privileged or system level on the target machine. The weakness matches CWE‑416 and CWE‑362, reflecting a race condition that leads to use after free.

Affected by design are Microsoft Windows 10 release 1809, 21H2 and 22H2 and Windows 11 releases 23H2, 24H2, 25H2, and 26H2, including both x64 and arm64 variants, as well as Microsoft Windows Server 2019 and its Server Core install.

The CVSS score of 7.0 classifies this as a high severity local privilege escalation. The EPSS score is not available and the flaw is not currently listed in CISA’s KEV catalog, suggesting no active widespread exploitation. Because the flaw requires an authorized local user context and no remote entry point is described, the attack vector is assumed to be local. A motivated attacker with local access could exploit the loss of isolation this creates, but gain is constrained to the machine on which the service runs.