Windows Broadcast DVR User Service: Use-after-free allows local privilege escalation

Summary

A use-after-free vulnerability in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges. Successful exploitation would give an attacker high impact on confidentiality, integrity and availability. The attack requires local access with low privileges and a high attack complexity, so there is no remote exposure from this flaw alone.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server editions: Unknown.

Fixed in

• Security updates published in the November 2026 Windows update release, per the build numbers listed above (verify the KB for each build in the MSRC Security Update Guide).
• Server editions: Unknown.

Workaround

• No vendor workaround identified.
• Unknown whether Microsoft documents a workaround; check the MSRC FAQ.
• Unverified option: on systems where game recording and broadcast features are not used, the service could be disabled or set to manual. Test first, as the service may be in the startup path of some systems.

Exploitation

• Microsoft's CVSS vector indicates Exploit Code Maturity Unproven (E:U), i.e. no known exploit code at publication.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No public proof of concept found.
• Rapid7 reports exploitation in the wild for one November 2026 vulnerability; it is not confirmed whether this CVE is that one.

Our recommendation

• Install the November 2026 Windows security update on affected systems, prioritizing shared PCs, terminal servers and multi-user workstations.
• Verify the Windows build and the corresponding KB in the MSRC guide before rollout.
• Restrict local logon and limit local user accounts to reduce the chance of a local foothold.
• Monitor for unusual privilege escalation activity on affected systems until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113762 msrc.microsoft.com
• CVE Record CVE-2026-113762 (Microsoft CNA) www.cve.org
• Strix.ai: CVE-2026-113762 (secondary) www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• BcastDVRUserService service description batcmd.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:03.