A use‑after‑free bug in the Windows Broadcast DVR User Service grants an attacker with local authorization the ability to run code with elevated privileges. The flaw is a classic memory corruption issue (CWE‑416) that allows an attacker to redirect execution flow after the service frees a memory block. Once the vulnerability is triggered, the attacker can obtain higher privileges on the affected host, enabling further compromise of system integrity.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2, and Windows Server 2019 (including Server Core). All instances running the Broadcast DVR User Service are susceptible, regardless of architecture (x86, x64, or arm64).

The CVSS score of 7.8 indicates a high severity level. The EPSS score is currently unavailable, but the absence of a KEV listing suggests there are no known active exploits at the time of publication. The attack vector is local: an attacker must have authorized access to the system to exploit the use‑after‑free flaw. Consequently, the risk is significant for systems that grant user accounts administrative privileges or allow the Broadcast DVR User Service to run under elevated contexts.