Windows Broadcast DVR User Service: Local privilege escalation via use-after-free

Summary

A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges. The attack requires an existing local account and high attack complexity, so it is a post-compromise risk rather than an internet-facing one. The CVSS v3.1 base score is 7.0 (High).

Affected

• Windows 10 Version 1809: builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974 (listed by a third-party aggregator only, not verified with Microsoft)
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server editions: not in the reviewed affected list; not verified

Fixed in

• Fixed builds per the CVE record: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974
• Fixed cumulative update KB numbers: Unknown.
• Do not assume the October 2026 updates for related Broadcast DVR CVEs cover this CVE.

Workaround

Unknown. No vendor workaround or mitigation was found.

• Until patched, limit local logons on shared and multi-user systems.
• Enforce least privilege for standard accounts.
• Monitor for crashes or restarts of the Broadcast DVR service.

Exploitation

• No confirmed in-the-wild exploitation found for this CVE. Microsoft's November 2026 exploitation status for this CVE is not confirmed in the reviewed sources.
• No public proof of concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• CVE record exploit code maturity: Unproven (E:U).

Our recommendation

• Install the November 2026 cumulative update on all affected Windows systems and confirm the installed build against the fixed builds.
• Prioritise multi-user systems, terminal servers and file servers.
• Check whether each system is still in standard support, because older builds such as Windows 10 1809 and 21H2 may not receive the patch.
• Verify the exact CVE ID and build mapping on the MSRC Security Update Guide, since several near-identical Broadcast DVR CVEs exist.
• Restrict local logons and enforce least privilege until the patch is installed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112761 msrc.microsoft.com
• CVE Record: CVE-2026-112761 www.cve.org
• Rapid7: Patch Tuesday November 2026 review www.rapid7.com
• Strix: CVE-2026-112761 (third-party listing) www.strix.ai
• Vulners: look-alike Broadcast DVR CVE MS:CVE-2026-96919 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:18.