Windows Broadcast DVR User Service: Heap-based buffer overflow in privilege escalation

Summary

A heap-based buffer overflow in the Windows Broadcast DVR User Service allows an authorized local user to elevate privileges to a higher level. An attacker needs a valid local account or an existing foothold on the system, and the CVSS vector rates attack complexity as high. The flaw is not reachable remotely over the network.

Affected

• Microsoft Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9487
• Microsoft Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7846
• Microsoft Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7846
• Microsoft Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7711
• Microsoft Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
• Microsoft Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
• Microsoft Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
• Microsoft Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974

Note: the research notes list fewer builds; Windows Server is not confirmed. Verify the list in the MSRC advisory.

Fixed in

• Minimum patched builds per the CNA record: 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974
• KB numbers: Unknown. Confirm the KB mapping in the MSRC advisory before rollout.

Workaround

• Unknown: no vendor-confirmed mitigation found.
• If the service is not required, stop and disable it to remove the vulnerable code path. Verify this against MSRC first.
• Apply least privilege and restrict which local accounts can run untrusted binaries.

Exploitation

• No known exploitation in the wild at the time of research.
• No public proof of concept found.
• CISA SSVC: exploitation none, automatable no, technical impact total. CVSS temporal vector uses E:U (exploit code maturity unknown).

Our recommendation

• Inventory Windows 10 and 11 systems and compare their builds with the minimum patched versions.
• Install the security update from MSRC. Windows 10 21H2 and 22H2 may require Extended Security Updates; check Microsoft's lifecycle pages.
• Disable Broadcast DVR on systems where game capture is not needed.
• Prioritise shared workstations and terminal servers.
• Monitor CISA KEV and public PoC sources for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-95871 msrc.microsoft.com
• CVE Record CVE-2026-95871 www.cve.org
• Strix CVE-2026-95871 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:05.