Microsoft Windows: Use-after-free in Broadcast DVR User Service allows privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local attacker to elevate privileges. The attacker needs a local account or an existing foothold on the host, and the attack complexity is rated high. The CVSS base score is 7 (High), and CISA SSVC rates the technical impact as total.

Affected

• Windows 10 Version 1809 (build 10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 before 10.0.19045.7807; the CNA record lists 19044 as the upper bound, which appears to be a typo)
• Windows 11 Version 23H2 (build 10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 before 10.0.26300.9711)

Fixed in

• Windows 10 Version 1809 / Server 2019: build 10.0.17763.9376 or later (October 2026 update, reported as KB5126651; not yet confirmed on MSRC)
• Other affected versions: the fixed builds listed above, per the Microsoft CNA data
• Windows 11 23H2: reported as KB5126653 by third-party data; not yet confirmed on MSRC

Workaround

Unknown.

Exploitation

• CISA SSVC: exploitation none, automatable no
• VulDB: no exploit available
• No public proof of concept found
• Known exploitation in the wild or CISA KEV listing: not verified
• EPSS 0.00252 (low predicted exploitation probability)

Our recommendation

• Install the October 2026 security update on all affected Windows 10 and Windows 11 systems, prioritising shared workstations, terminal servers (RDS) and hosts with local user accounts.
• Check whether Windows 10 Version 1809 or Server 2019 is still in use and plan its replacement or upgrade.
• Confirm the fixed build and KB number on the Microsoft Security Update Guide before rollout.
• Restrict local logons on servers and monitor for unexpected privilege changes on affected hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102193 msrc.microsoft.com
• NVD mirror (vulners): CVE-2026-102193 vulners.com
• CNA record mirror (vulners): CVE-2026-102193 vulners.com
• VulDB: CVE-2026-102193 vuldb.com
• PT Security advisory listing PT-2026-111904 (KB mapping) vulners.com
• Strix AI mirror: CVE-2026-102193 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:58.