CVE-2026-103554

HighCVSS 7.0/10Last modified Oct 16, 2026

Description

Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1035557.0Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1035587.5Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.CVE-2026-1035605.5Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.CVE-2026-1035657.0Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.CVE-2026-1035675.5Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.CVE-2026-1035687.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorCVE-2026-1035697.5Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.CVE-2026-1035728.8Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows anCVE-2026-1035758.8Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-1035766.5Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perfoCVE-2026-1035777.5Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1035786.8Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-103554: High severity, CVSS 7.0 | Vulnix