Windows Broadcast DVR User Service: Use-after-free privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Broadcast DVR User Service allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege account on the system and must run code locally, and attack complexity is high. CISA SSVC rates technical impact as total, but exploitation is rated none and the vulnerability is not automatable.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376\n- Windows 10 Version 21H2: builds before 10.0.19044.7807\n- Windows 10 Version 22H2: builds before 10.0.19045.7807\n- Windows 11 Version 23H2: builds before 10.0.22631.7652\n- Windows 11 Version 24H2: builds before 10.0.26100.9711\n- Windows 11 Version 25H2: builds before 10.0.26200.9711\n- Windows 11 Version 26H1: builds before 10.0.28000.3231\n- Windows 11 Version 26H2: builds before 10.0.26300.9711

Fixed in

• Windows 10 1809 / Server 2019: 10.0.17763.9376 (KB5126651, unverified)\n- Windows 10 21H2: 10.0.19044.7807 (KB5126657, unverified)\n- Windows 10 22H2: 10.0.19045.7807 (KB5126657, unverified)\n- Windows 11 23H2: 10.0.22631.7652 (KB5126653, unverified)\n- Windows 11 24H2 / 25H2 / 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711 (KB5127648 and KB5127646, unverified)\n- Windows 11 26H1: 10.0.28000.3231\nThe fix is the October 2026 cumulative security update for each build. KB numbers come from third-party mirrors and must be confirmed on MSRC or the Microsoft Update Catalog.

Workaround

Unknown. No vendor-documented workaround was found. Until patching, limit local logons on shared or multi-user hosts such as terminal servers and kiosks, and enforce least privilege.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total\n- No reports of exploitation in the wild found\n- No public proof of concept found\n- EPSS is low (about 0.0025 to 0.0028)

Our recommendation

• Deploy the October 2026 cumulative update to all affected Windows 10 and Windows 11 systems and Windows Server 2019 hosts in the normal patch cycle, prioritising multi-user systems and servers\n- Check the support status of Windows 10 1809 and Server 2019 systems and plan upgrades if they are end of life\n- Restrict local logons and apply least privilege on shared PCs and terminal servers until patched

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide (CVE-2026-108461) msrc.microsoft.com
• MSRC Security Update Guide (en-US) msrc.microsoft.com
• NVD mirror (Vulners) vulners.com
• CNA version data (Vulners) vulners.com
• Microsoft CVE listing (Vulners) vulners.com
• PT-2026-112023 (Vulners) vulners.com
• Strix CVE page www.strix.ai
• EUVD-2026-99082 (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:43.