Executive brief
Windows Broadcast DVR User Service is a system component that handles video recording and streaming on Windows. An authorized local attacker can exploit a memory safety flaw in this service to gain elevated system privileges, potentially compromising the entire computer.
Technical details
A use-after-free vulnerability exists in the Windows Broadcast DVR User Service, a privileged system component responsible for broadcast and DVR functionality. The vulnerability allows an authorized local attacker to execute arbitrary code with elevated privileges by exploiting freed memory references. Attack preconditions include local access and valid user credentials; the vulnerability is not known to be actively exploited in the wild at this time. Successful exploitation results in privilege escalation from a standard user context to a higher privilege level, enabling complete system compromise.
Affected products
- Microsoft Windows Broadcast DVR User Service
Timeline
- 2026-09-08: disclosed