Microsoft Windows: Use-after-free privilege escalation in Broadcast DVR service

Summary

A use-after-free flaw in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges to a higher level, with a CVSS 3.1 base score of 7.8. An attacker needs a valid local account or code execution as a low-privileged user, and no user interaction is required. The flaw is not remotely exploitable on its own, but once used it can lead to full compromise of the affected system.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807 (source data partly inconsistent, verify on MSRC)
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 (KB5126868, October 13, 2026)
• Other affected versions: October 2026 cumulative updates with the builds listed above (Tenable lists KB5126651 for Version 1809; verify on MSRC)

Workaround

Unknown. One aggregator recommends temporarily disabling the Windows Broadcast DVR User Service until patching. Microsoft's advisory does not confirm this, so verify it on MSRC before use.

Exploitation

• No evidence found of in-the-wild exploitation or a public proof of concept.
• CISA SSVC data: Exploitation none, Automatable no.
• Whether this CVE is in the CISA KEV catalogue is unknown; a Tenable plugin for the bulletin lists a KEV due date but does not clearly link it to this CVE.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows systems, starting with shared computers and systems with many local users.
• Check whether Windows 10 Version 1607 and other old builds are still supported, because unsupported builds will not receive the fix.
• Confirm the fixed build numbers on the MSRC advisory before deployment.
• Recheck the CISA KEV catalogue and monitor for exploitation.
• Restrict local logons and limit malware that can run code under user accounts.
• Priority: medium to high, depending on how many users have local access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88105 msrc.microsoft.com
• Microsoft KB5126868 for Windows 10 1607 (security update) support.microsoft.com
• CVELIST record for CVE-2026-88105 (Vulners) vulners.com
• OpenCVE record for CVE-2026-88105 app.opencve.io
• VulDB entry 419403 vuldb.com
• Tenable plugin 365471 for bulletin KB5126868 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:25.