{"id":"CVE-2026-88221","kind":"vulnerability","aliases":["CVE-2026-88221"],"related":[],"title":"Windows Broadcast DVR service flaw lets a local user gain higher privileges","description":"Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Broadcast DVR User Service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows"],"not_affected_if":[],"how_to_check":"Run winver (or [Environment]::OSVersion in PowerShell) and compare the full build number to the fixed builds: 1809 < 10.0.17763.9487, 21H2 < 10.0.19044.7846, 22H2 < 10.0.19045.7846, Win11 23H2 < 10.0.22631.7711, Win11 24H2 < 10.0.26100.9974 are vulnerable. Also check Windows 11 25H2/26H2 and Server builds against the MSRC page for this CVE; they share the 24H2 code base but the CVE record I read does not list them.","fix":"Install the November 10, 2026 cumulative update: Windows 10 1809 to build 10.0.17763.9487; Windows 10 21H2 to 10.0.19044.7846 (KB5131096); Windows 10 22H2 to 10.0.19045.7846 (KB5131096); Windows 11 23H2 to 10.0.22631.7711 (KB5131087); Windows 11 24H2 to 10.0.26100.9974 (KB5132061). Build numbers from a CVE-record mirror; MSRC page not readable, so not verified.","status":"open","published_at":"2026-11-10T19:21:29+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:50:05+00:00","updated_at":"2026-11-10T20:47:55+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Broadcast DVR service flaw lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Broadcast DVR User Service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-88221 in the Microsoft Security Update Guide; the NVD entry has no product ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide for CVE-2026-88221\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a local user with an account could run code to gain administrator rights. The sources do not state which Windows builds are affected or whether the Broadcast DVR service must be enabled. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4490,"output_tokens":458,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-88221 in the Microsoft Security Update Guide; the NVD entry has no product ranges.","search":"'-2026':14A,17A '-88221':15A,18A '10':20A,23A,26A '11':29A,32A '1809':21A '21h2':24A '22h2':27A '23h2':30A '24h2':33A 'account':61B 'allow':82C 'alreadi':57B 'attack':55B,85C 'author':84C 'broadcast':2A,49B,78C 'bug':45B 'cve':13A,16A 'describ':69B 'dvr':3A,50B,79C 'elev':87C 'escal':38B 'flaw':5A 'free':44B,75C 'gain':10A 'higher':11A 'infrastructur':34B 'let':6A,53B 'local':8A,35B,60B,89C 'privileg':12A,37B,64B,88C 'privilege-escal':36B 'rais':62B 'remot':71B 'servic':4A,52B,81C 'sourc':66B 'trigger':72B 'use':42B,73C 'use-after-fre':41B 'user':9A,51B,80C 'window':1A,39B,48B,77C 'windows':19A,22A,25A,28A,31A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1809, 21H2, 22H2) and Windows 11 (23H2, 24H2) machines running a build older than the November 2026 cumulative update. An attacker needs a local account already and the attack is rated high complexity, so shared machines, terminal servers, VDI and developer or build hosts matter most. Single-user machines with no untrusted local code carry less risk. No exploitation or public PoC is reported.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88221':15A,18A '10':20A,23A,26A '11':29A,32A '1809':21A '21h2':24A '22h2':27A '23h2':30A '24h2':33A 'broadcast':2A 'cve':13A,16A 'dvr':3A 'flaw':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'privileg':12A 'servic':4A 'user':9A 'window':1A 'windows':19A,22A,25A,28A,31A","search_b":"'account':61B 'alreadi':57B 'attack':55B 'broadcast':49B 'bug':45B 'describ':69B 'dvr':50B 'escal':38B 'free':44B 'infrastructur':34B 'let':53B 'local':35B,60B 'privileg':37B,64B 'privilege-escal':36B 'rais':62B 'remot':71B 'servic':52B 'sourc':66B 'trigger':72B 'use':42B 'use-after-fre':41B 'user':51B 'window':39B,48B","search_c":"'allow':82C 'attack':85C 'author':84C 'broadcast':78C 'dvr':79C 'elev':87C 'free':75C 'local':89C 'privileg':88C 'servic':81C 'use':73C 'user':80C 'window':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88221","severity":null,"published_at":"2026-11-10T19:21:29+00:00","modified_at":"2026-11-10T19:21:30+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88221:2706","url":"https://radar.offseq.com/threat/cve-2026-88221-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-a818aea3bf05310e","severity":null,"published_at":"2026-11-10T20:47:55+00:00","modified_at":"2026-11-10T20:47:55+00:00","first_seen_at":"2026-11-10T20:47:55+00:00","fetched_at":"2026-11-10T20:47:55+00:00","note":"Could not read MSRC page (empty). Affected/fixed builds taken from OffSeq mirror of the CVE record, KBs from Patch Tuesday roundups; nothing marked verified. Not exploited per sources. Note: CVE-2026-108461 (Oct) is a separate sibling CVE with the same description.","cites":["https://radar.offseq.com/threat/cve-2026-88221-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-a818aea3bf05310e","https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/"]}],"documents":[{"id":118289,"url":"https://radar.offseq.com/threat/cve-2026-88221-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-a818aea3bf05310e","title":"OffSeq: CVE-2026-88221 affected and fixed builds (mirror of CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118027,"url":"https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/","title":"Patch Tuesday cumulative updates, November 10, 2026 (Winaero)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}