{"id":"CVE-2026-113762","kind":"vulnerability","aliases":["CVE-2026-113762"],"related":[],"title":"Windows: Broadcast DVR service flaw lets a local user gain privileges","description":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's CVE record (published 2026-11-10) describes a use-after-free in the Windows Broadcast DVR User Service that lets an authorized local attacker elevate privileges. CVSS 7.0 (AV:L/AC:H/PR:L/UI:N). CISA SSVC lists exploitation as none. No public PoC found.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","use-after-free","windows","windows-10","windows-11"],"not_affected_if":[],"how_to_check":"Run winver or [Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.xxxx) to the fixed builds. Lower than the fixed build means exposed. Whether the Broadcast DVR User Service (BcastDVRUserService) is enabled by default is not confirmed; check with Get-Service BcastDVRUserService*.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: Win10 1809 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H2 10.0.26300.9974; Win11 26H1 10.0.28000.3501. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T19:52:17+00:00","updated_at":"2026-11-11T00:16:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:52:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Broadcast DVR service flaw lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Broadcast DVR User Service lets an already-logged-in user raise their privileges on the same machine. The sources do not say what code path triggers it or what exact privileges are gained beyond elevation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user becomes administrator or SYSTEM on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113762 for affected Windows builds, the fixed update, and whether the service is enabled by default.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Broadcast DVR User Service","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows machines running the Broadcast DVR User Service; the attacker must already have an authorized local account. The sources do not say which Windows builds are affected or whether the service runs by default.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4490,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113762 for affected Windows builds, the fixed update, and whether the service is enabled by default.","search":"'-10':53B,63B '-11':55B,62B '-113762':14A,17A '-2026':13A,16A '10':19A,22A,25A '11':28A,31A,34A,37A,40A '1809':20A '2026':61B '21h2':23A '22h2':26A '23h2':29A '24h2':32A '25h2':35A '26h1':41A '26h2':38A '7.0':86B 'allow':111C 'attack':82B,114C 'author':80B,113C 'av':87B 'broadcast':2A,73B,107C 'cisa':92B 'cve':12A,15A,58B 'cvss':85B 'describ':64B 'dvr':3A,74B,108C 'elev':83B,116C 'escal':46B 'exploit':95B 'flaw':5A 'found':101B 'free':50B,69B,104C 'gain':10A 'h/pr':89B 'infrastructur':42B 'l/ac':88B 'l/ui':90B 'let':6A,78B 'list':94B 'local':8A,44B,81B,118C 'local-privilege-escal':43B 'microsoft':56B 'n':91B 'none':97B 'poc':100B 'privileg':11A,45B,84B,117C 'public':99B 'publish':60B 'record':59B 'servic':4A,76B,110C 'ssvc':93B 'use':48B,67B,102C 'use-after-fre':47B,66B 'user':9A,75B,109C 'window':1A,51B,52B,54B,72B,106C 'windows':18A,21A,24A,27A,30A,33A,36A,39A","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines running the Broadcast DVR User Service; the attacker must already have an authorized local account. The sources do not say which Windows builds are affected or whether the service runs by default.","tier":"B","verified":{"fix":{"at":"2026-11-11T00:16:04Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-113762","run_id":3312},"products":{"at":"2026-11-11T00:16:04Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-113762","run_id":3312}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","25h2","26h1","26h2","windows"],"labels":["high","infrastructure","localprivilegeescalation","useafterfree","vendor","windows","windows10","windows11"],"campaign_type":null,"search_a":"'-113762':14A,17A '-2026':13A,16A '10':19A,22A,25A '11':28A,31A,34A,37A,40A '1809':20A '21h2':23A '22h2':26A '23h2':29A '24h2':32A '25h2':35A '26h1':41A '26h2':38A 'broadcast':2A 'cve':12A,15A 'dvr':3A 'flaw':5A 'gain':10A 'let':6A 'local':8A 'privileg':11A 'servic':4A 'user':9A 'window':1A 'windows':18A,21A,24A,27A,30A,33A,36A,39A","search_b":"'-10':53B,63B '-11':55B,62B '2026':61B '7.0':86B 'attack':82B 'author':80B 'av':87B 'broadcast':73B 'cisa':92B 'cve':58B 'cvss':85B 'describ':64B 'dvr':74B 'elev':83B 'escal':46B 'exploit':95B 'found':101B 'free':50B,69B 'h/pr':89B 'infrastructur':42B 'l/ac':88B 'l/ui':90B 'let':78B 'list':94B 'local':44B,81B 'local-privilege-escal':43B 'microsoft':56B 'n':91B 'none':97B 'poc':100B 'privileg':45B,84B 'public':99B 'publish':60B 'record':59B 'servic':76B 'ssvc':93B 'use':48B,67B 'use-after-fre':47B,66B 'user':75B 'window':51B,52B,54B,72B","search_c":"'allow':111C 'attack':114C 'author':113C 'broadcast':107C 'dvr':108C 'elev':116C 'free':104C 'local':118C 'privileg':117C 'servic':110C 'use':102C 'user':109C 'window':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113762","severity":null,"published_at":"2026-11-10T19:18:55+00:00","modified_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113762:3312","url":"https://cveawg.mitre.org/api/cve/CVE-2026-113762","severity":null,"published_at":"2026-11-11T00:16:04+00:00","modified_at":"2026-11-11T00:16:04+00:00","first_seen_at":"2026-11-11T00:16:04+00:00","fetched_at":"2026-11-11T00:16:04+00:00","note":"Read Microsoft CNA CVE record via cveawg (MSRC page is JS-only, unreadable). Fixed builds from that record; KB numbers and default service state not confirmed. Fix and products verified from the CNA record only.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-113762"]}],"documents":[{"id":120575,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-113762","title":"CVE-2026-113762 CVE record (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}