CVE-2026-96919

7.0High

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.0High

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-362, CWE-416

Impact

A local user can gain elevated system privileges. They need local logon access and valid user credentials on the target Windows machine to trigger it.

Root cause

A race condition leading to a use-after-free bug in the Windows Broadcast DVR User Service (BcastDVRUserService).

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the security update referenced in the Microsoft Security Update Guide advisory. If patching must wait, disable the Windows Broadcast DVR User Service via the registry or service management tools.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96919

Source: nvd.nist.gov/vuln/detail/CVE-2026-96919