IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows 11: Use-after-free in Broadcast DVR User Service allows privilege escalation

CVE-2026-102195High 7.0

← All vulnerabilities

Summary

A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorised local user to elevate privileges to a higher level. The attacker needs local access with low privileges and must win a race-type condition (AC:H), so it is a follow-on step after an initial compromise rather than an entry point. The CVSS score is 7.0 (High) per NVD and the CNA, with a total impact on confidentiality, integrity and availability. Microsoft has released fixes in the October 2026 security update.

Affected

  • Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
  • Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9711
  • Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
  • Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
  • Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
  • Note: the CPE entry in the request lists only 23H2. The CNA record covers all five versions above.

Fixed in

  • Windows 11 23H2: build 10.0.22631.7652 or later
  • Windows 11 24H2: build 10.0.26100.9711 or later
  • Windows 11 25H2: build 10.0.26200.9711 or later
  • Windows 11 26H1: build 10.0.28000.3231 or later
  • Windows 11 26H2: build 10.0.26300.9711 or later
  • Update KB numbers reported by aggregators (not verified against MSRC): KB5126653 (23H2), KB5127646 (26H1), KB5127648 (24H2, 25H2, 26H2).

Workaround

No vendor-documented workaround known. Whether Microsoft has published an interim mitigation is unknown; check the MSRC advisory.

Exploitation

  • No known exploitation in the wild at the time of research.
  • No public proof of concept found.
  • Not listed in the CISA KEV catalogue.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • EPSS is low (0.00252).
  • Absence of reports is not confirmation that the flaw is unexploited.

Our recommendation

  • Deploy the October 2026 cumulative update to all Windows 11 clients, prioritising any unmanaged or shared machines.
  • Inventory Windows 11 builds across all clients, not only 23H2, to find all affected versions.
  • Monitor the MSRC advisory and CISA KEV for changes in exploitation status.
  • Several related Broadcast DVR use-after-free CVEs were published the same day, so one patch cycle covers them.
  • Note: NVD and the CNA give CVSS 7.0, while VulDB gives 8.8 for the same vector. Use the NVD score for internal rating unless you decide otherwise.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Broadcast DVR User Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows
Updates (KB)
KB5127648, KB5126653, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:55.

Original description (NVD)

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed