Microsoft Windows: Use-after-free elevation of privilege in Broadcast DVR User Service

Summary

A use-after-free flaw (CWE-416) in the Windows Broadcast DVR User Service allows a local user with low privileges to elevate privileges, potentially up to SYSTEM. The CVSS 3.1 base score is 7.0 (High), with high impact on confidentiality, integrity and availability. Exploitation requires a local foothold and a high attack complexity, and the attacker cannot exploit it remotely or without an account.

Affected

• Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974
• Windows Server editions: Unknown.

Fixed in

Fixed in the Microsoft security updates of November 10, 2026 (Patch Tuesday). Fixed builds are the builds listed as upper limits above. KB numbers: Unknown. Verify the exact build numbers on the MSRC advisory before deployment.

Workaround

Unknown. No Microsoft-documented workaround was identified. Installing the security update is the remediation.

Exploitation

• Not known to be exploited in the wild (CISA SSVC: exploitation none, automatable no).
• No public proof of concept known.
• Not listed in CISA KEV in the sources checked.
• Technical impact rated total by CISA SSVC.

Our recommendation

• Install the November 2026 security updates on all affected Windows 10 and Windows 11 systems in the normal monthly cycle, with priority on multi-user hosts, terminal servers and file servers.
• Check that Windows 10 Version 1809, 21H2 and 22H2 devices still receive security updates; unsupported builds will not receive this fix.
• Restrict local logon to trusted users and monitor for unusual privilege escalation to SYSTEM.
• Re-check the CVE status and exploitation information after the NVD analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88221 msrc.microsoft.com
• CVE.org record CVE-2026-88221 www.cve.org
• NewsBeep: Microsoft November 2026 Patch Tuesday www.newsbeep.com
• CyberScoop: Microsoft Patch Tuesday November 2026 cyberscoop.com
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
• Strix: CVE-2026-88221 (third-party, provisional) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:13.