Windows 10 1809: Use-after-free in Broadcast DVR User Service

Summary

A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows a local user with low privileges to elevate privileges. The attacker must already be able to run code or log on to the affected system, and no user interaction is required. Successful exploitation can lead to full control of the affected host (CVSS 3.1: 7.8, High).

Affected

• Microsoft Windows 10 Version 1809 (build 10.0.17763.0 to below 10.0.17763.9376)
• Microsoft Windows Server 2019 and Server 2019 Server Core (build 10.0.17763.0 to below 10.0.17763.9376)
• Further versions listed in the CNA record: Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2 (see MSRC for exact ranges)

Fixed in

• Windows 10 1809 and Server 2019: build 10.0.17763.9376 or later (October 2026 update KB5126651)
• Windows 10 21H2: build 10.0.19044.7807 or later
• Windows 10 22H2: build 10.0.19045.7807 or later (per CNA record; confirm on MSRC)
• Windows 11 23H2: build 10.0.22631.7652 or later
• Windows 11 24H2, 25H2 and 26H2: build 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 or later
• Windows 11 26H1: build 10.0.28000.3231 or later

Workaround

Unknown. No vendor-documented workaround was found; apply the update.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No evidence of in-the-wild exploitation or a public proof of concept for this CVE was found.
• Tenable's exploit flag applies to the whole update bundle and is not confirmed for this CVE.

Our recommendation

• Inventory Windows 10 1809 and Server 2019 hosts and check whether the build is below 10.0.17763.9376.
• Install the October 2026 update (KB5126651 for 1809 and Server 2019) and verify the build afterwards.
• Prioritise multi-user systems, RDS and terminal servers, and hosts where staff or third parties have logons.
• Check whether 1809 is still supported for your edition, and monitor CISA KEV and public PoC sources for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-102196) msrc.microsoft.com
• Vulners: CNA record CVELIST:CVE-2026-102196 vulners.com
• Vulners: NVD record CVE-2026-102196 vulners.com
• Tenable plugin 365475 (October 2026 update for 1809 and Server 2019) www.tenable.com
• Tenable plugin 365465 (October 2026 update for Windows 11 23H2) www.tenable.com
• Microsoft CVE list PDF (2026) cdn-dynmedia-1.microsoft.com
• Strix: CVE-2026-102196 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:17.