Windows: Use-after-free in Broadcast DVR User Service

Summary

Microsoft Windows, including Windows 10 Version 1809 and Windows Server 2019, contains a use-after-free flaw in the Broadcast DVR User Service. A locally authenticated attacker with low privileges can exploit it to gain higher privileges on the system. The attack requires local access and a high-complexity condition, so the flaw is not directly reachable from the internet but matters after an attacker has a foothold, for example through a phished user or malware.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711

Note: The CPE in the CVE record lists only Windows 10 1809; the CNA record lists the products above.

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: KB5126651 (OS Build 17763.9376), released 13 October 2026
• Windows 10 Version 21H2 and 22H2: KB5126657 (OS Builds 19044.7807 and 19045.7807)
• Other listed versions: first fixed builds as stated in the CNA record above; verify the update numbers on the MSRC page.

Workaround

Unknown.

• No vendor workaround was found in the sources. Check the MSRC page for any mitigation.

Exploitation

• No public exploit code found.
• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft temporal vector E:U (exploit code maturity unproven).
• EPSS about 0.25 percent (Vulners mirror).

Our recommendation

• Install the October 2026 security updates on all affected Windows 10 and Windows Server hosts, starting with multi-user servers and terminal servers where local low-privilege accounts exist.
• Until patched, limit interactive local logons and restrict which accounts can log on to servers and workstations.
• Plan the replacement of Windows 10 Version 1809 hosts, which are largely out of support and no longer receive fixes.
• Verify the fixed builds and any workaround on the MSRC page.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-103554 msrc.microsoft.com
• NVD mirror (Vulners) CVE-2026-103554 vulners.com
• VulDB entry vuldb.com
• KB5126651 Windows 10 1809 security update support.microsoft.com
• KB5126657 Windows 10 21H2/22H2 security update support.microsoft.com
• Patch overview Microsoft (BaselineWatch) baselinewatch.org
• Windows 10 1809 and Windows Server 2019 release health learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:51.