The vulnerability is a use‑after‑free flaw in the Windows Broadcast DVR User Service that can be triggered by sending malicious data to the service. The flaw allows a local attacker with authorized access to corrupt memory references and execute code with the privileges of the service, resulting in local privilege escalation and the potential to gain system level access.

Microsoft Windows 10 from version 1809 through 22H2, Microsoft Windows 11 from versions 23H2 through 26H2 (including the 26H1 image), and Microsoft Windows Server 2019 and its Server Core installation of Windows Server 2019.

The CVSS score of 7.8 indicates a high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires a local authorized user; it is not remotely exploitable. This means the risk surface is limited to machines where a user can run code locally or where a malicious application may be installed. The lack of a publicly known exploit and the need for local execution reduce the likelihood of widespread attacks, but the impact remains significant due to the privilege‑escalation potential.