Vulnerabilities
CVE-2026-105722: Windows Broadcast DVR User Service Use‑After‑Free Privilege Escalation
A use‑after‑free flaw in the Windows Broadcast DVR User Service allows a local attacker to gain elevated privileges. The vulnerability is exploitable on systems running the affected service and can be mitigated by applying the latest Microsoft security update or disabling the service. Defenders should verify patch status and monitor for anomalous privilege escalation events.
What Happened
A use‑after‑free bug in the Windows Broadcast DVR User Service (CVE‑2026‑105722) enables a local attacker to execute code with SYSTEM privileges. The flaw occurs when the service frees memory that is still referenced, allowing crafted input to trigger privileged code paths.
Impact
Systems running the affected Broadcast DVR User Service are at risk of local privilege escalation. An attacker who can run code on the target machine can gain full control, install malware, or pivot to other network resources.
What to Do
- Apply the latest Microsoft security update that addresses CVE‑2026‑105722.
- If patching is not immediately possible, disable the Broadcast DVR User Service via the Services console or group policy.
- Restrict local user privileges and enforce least‑privilege principles to limit potential damage.
- Monitor for anomalous SYSTEM‑level activity using event logs (Event ID 4688, 4672) and memory corruption alerts.
Detection Tips
Look for unexpected process creation with SYSTEM rights and memory access violations in Windows Defender logs. A sudden spike in Event ID 4624 with Logon Type 10 (Remote Interactive) from a local account may indicate exploitation.
Related vulnerabilities
CVE-2026-70056: Windows Update Service Use-After-Free Allows Local Privilege Escalation
A use‑after‑free flaw in the Windows Update Service (wuauserv) lets an authorized local user gain SYSTEM privileges. The vulnerability affects Windows 10 and Windows 11 systems and can be mitigated by installing the latest Microsoft patch and enforcing least‑privilege controls.
Read briefing
CVE-2026-72969: Windows Program Compatibility Assistant Service Local Privilege Escalation
A local use‑after‑free flaw in the Windows Program Compatibility Assistant Service allows an attacker with user privileges to elevate to SYSTEM. The issue is present in all Windows 10/11 builds that ship with the service and can be remediated by applying the latest Microsoft patch or disabling the service.
Read briefing
Windows Storage Use-After-Free Enables Local Privilege Escalation (CVE-2026-69763)
A use‑after‑free flaw in Windows Storage allows an authorized local user to elevate privileges. The vulnerability affects Windows 10, 11, Server 2019, and 2022. Defenders should apply the latest cumulative update and enforce least‑privilege policies.
Read briefing
CVE-2026-72955: Windows Application Compatibility Cache Use-After-Free Privilege Escalation
A local use‑after‑free flaw in the Windows Application Compatibility Cache allows an authenticated user to gain SYSTEM privileges. The vulnerability affects all Windows systems that use the cache and can be mitigated by installing the latest security updates. Defenders should verify patch status and monitor for anomalous privilege changes.
Read briefing