Windows Broadcast DVR User Service: Use-after-free allows local privilege escalation

Summary

A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges. The Microsoft CVE record rates the CVSS 3.1 base score at 7.0 (High) with high impact on confidentiality, integrity and availability. Exploitation requires local access with low privileges and a high-complexity condition, and there is no user interaction; the flaw is not remotely exploitable.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974

Fixed in

• Builds at or above the listed values in the Microsoft CVE record. Confirm the exact fixed builds and the KB article on the MSRC Security Update Guide.
• KB article: Unknown.

Workaround

• Unknown. No Microsoft-published workaround was found.
• Unverified fallback for testing only: disable Game DVR / Broadcast DVR on hosts that do not need it.

Exploitation

• Microsoft rates exploit maturity as Unproven (E:U).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept or reports of in-the-wild exploitation were found. KEV listing: Unknown.

Our recommendation

• Check the MSRC advisory for the authoritative build list and KB number.
• Inventory Windows 10 and 11 hosts, with priority on multi-user systems, terminal servers and shared workstations.
• Install the update through the normal Patch Tuesday cycle.
• Where patching is delayed, consider disabling Game DVR / Broadcast DVR after testing.
• Limit local accounts and monitor for privilege escalation to SYSTEM.
• Recheck the CISA KEV catalog and the vendor advisory for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119403 msrc.microsoft.com
• CVE Record CVE-2026-119403 www.cve.org
• Strix: CVE-2026-119403 www.strix.ai
• CISA alert: six KEV additions, 10 November 2026 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:47.