This vulnerability arises from a use‑after‑free flaw in the Windows Broadcast DVR User Service. An attacker who can execute code from an authenticated session can exploit the memory release logic to execute arbitrary code with elevated local privileges. The flaw allows the attacker to gain higher privilege levels on the target machine, potentially compromising the entire system by acquiring system‑level access, installing additional software, or modifying critical system files.

The flaw affects Microsoft Windows 10 release 1809, 21H2 and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, as well as Windows 11 26H1, and Windows Server 2019 including Server Core installation. The affected platforms span x86, x64, arm64, and arm64‑based systems as listed by Microsoft.

With a CVSS score of 7 and no EPSS data available, the vulnerability presents a moderate‑to‑high risk profile. The flaw is exploitable by a local user with sufficient privileges to interact with the Broadcast DVR User Service, as inferred from the term "authorized attacker" in the description. There is no record of exploitation in the CISA KEV catalog, but the use‑after‑free nature suggests that local code execution can be achieved if an attacker crafts suitable input to the service. The absence of a published exploit does not diminish the necessity of applying the vendor’s patch promptly.