IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows: Use-after-free in Broadcast DVR User Service

CVE-2026-103565High 7.0

← All vulnerabilities

Summary

A use-after-free flaw (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges. An attacker needs a valid low-privilege account on the affected host and high attack complexity applies, so the flaw is an escalation step after an initial foothold rather than an internet-facing entry point. The NVD score is CVSS 7.0 (HIGH), while VulDB lists 8.8. No exploitation has been reported.

Affected

  • Windows 10 Version 1809 (builds below 10.0.17763.9376)
  • Windows 10 Version 21H2 (builds below 10.0.19044.7807)
  • Windows 10 Version 22H2 (builds below 10.0.19045.7807)
  • Windows 11 Version 23H2 (builds below 10.0.22631.7652)
  • Windows 11 Version 24H2 (builds below 10.0.26100.9711)
  • Windows 11 Version 25H2 (builds below 10.0.26200.9711)
  • Windows 11 Version 26H1 (builds below 10.0.28000.3231)
  • Windows 11 Version 26H2 (builds below 10.0.26300.9711)
  • Windows Server 2019, including Server Core (builds below 10.0.17763.9376)

Note: the NVD CPE lists only Windows 10 1809; the CNA data lists the products above.

Fixed in

  • Microsoft security updates of October 13, 2026, for each affected build. Per aggregator listings (unverified): KB5126651 (17763.9376), KB5126657 (19044.7807 and 19045.7807), KB5127648 (26100, 26200 and 26300 at 9711), KB5126653 (22631.7652), KB5127646 (28000.3231). Verify the KB numbers on the MSRC advisory before rollout.

Workaround

Unknown. No mitigation is documented in the sources reviewed; the patch is the only known remediation.

Exploitation

  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • No evidence of active exploitation found; not verified against CISA KEV.
  • No public proof of concept found.
  • EPSS 0.00252 (low).

Our recommendation

  • Deploy the October 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server 2019 hosts, after verifying the KB numbers on MSRC.
  • Prioritize shared workstations, terminal servers and hosts where untrusted users or malware may run.
  • Check for remaining Windows 10 1809 or Server 2019 hosts and verify their support status.
  • Monitor for unusual privilege escalation activity on endpoints.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Windows Broadcast DVR User Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5126651, KB5126657, KB5126653, KB5127648, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:48.

Original description (NVD)

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed