Use‑after‑free vulnerability in the Windows Broadcast DVR User Service allows an attacker that already has local authorization to gain elevated privileges. The flaw, identified as CWE‑416, can let the attacker transition from a normal user context to a SYSTEM‑level context, enabling full control over the machine, execution of arbitrary code, and potential manipulation of system files or services.

The flaw affects Microsoft Windows 10 builds 1809, 21H2 and 22H2, Windows 11 builds 23H2, 24H2, 25H2 and 26H2 (including ARM64 variants), as well as Windows Server 2019 and the Server Core installation. Both 32‑bit and 64‑bit x86/x64 platforms are impacted where listed.

The CVSS score of 7.8 indicates high severity. No EPSS data is available, and the issue is not currently listed in CISA’s KEV catalog. The attack vector is local and requires that the attacker runs malicious code as an authorized user. If exploited, the attacker can bypass local security boundaries and take control of the host.