CVE-2026-70148: Windows Broadcast DVR Information Leak

CVE-2026-70148 Overview

CVE-2026-70148 is an improper authorization vulnerability in the Windows Broadcast DVR User Service. An authenticated local attacker can leverage the flaw to disclose sensitive information outside the intended security boundary. Microsoft published the advisory on October 13, 2026, and the issue is tracked under CWE-441: Unintended Proxy or Intermediary.

The vulnerability requires local access and low privileges, with no user interaction. Because the scope changes when exploited, the attacker can access information belonging to another user or security context on the same system.

Critical Impact
An authorized local user can read confidential data from other security contexts through the Broadcast DVR User Service, bypassing intended access controls on Windows systems.

Affected Products

Microsoft Windows (Broadcast DVR User Service component)
See the Microsoft Security Update Guide for the authoritative list of affected builds
Systems where the Broadcast DVR User Service (BcastDVRUserService) is enabled

Discovery Timeline

2026-10-13 - CVE CVE-2026-70148 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70148

Vulnerability Analysis

The Windows Broadcast DVR User Service handles game recording, streaming, and broadcast features exposed through the Game Bar and related Xbox components. The service runs per-user and brokers access to media capture resources on behalf of the signed-in session.

The flaw stems from improper authorization checks within this service. When processing requests, the service does not sufficiently validate whether the calling principal is permitted to access the targeted resource or data. An authenticated attacker on the same host can issue crafted requests that cause the service to act as an unintended intermediary, returning information it should have withheld.

The scope change in the issue indicates the attacker crosses a security boundary. Information that belongs to another user context or a more privileged resource becomes readable. Integrity and availability are not directly affected, but the disclosed data may enable follow-on attacks such as credential theft or lateral movement.

Root Cause

The root cause maps to CWE-441: Unintended Proxy or Intermediary. The Broadcast DVR User Service forwards or resolves requests without enforcing the caller's authorization against the final resource. This confused-deputy pattern lets a low-privileged local caller leverage the service's own access rights.

Attack Vector

Exploitation requires local access and valid credentials with low privileges. The attacker interacts with the Broadcast DVR User Service through its exposed interprocess communication endpoints. No user interaction is needed. The attacker cannot execute code or modify data through this flaw, but they can read information that should remain isolated to another context.

No public proof-of-concept exploit is listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. The EPSS probability stands at 0.357%.

Technical specifics for the proxied call paths are available in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-70148

Indicators of Compromise

Unexpected processes communicating with BcastDVRUserService outside of normal game or streaming activity
Local user accounts accessing media or session data belonging to other logged-on users
Anomalous spawning of bcastdvr-related processes under service accounts or non-interactive sessions

Detection Strategies

Monitor Windows service activity for the Broadcast DVR User Service and correlate caller process identity against the owning user session
Hunt for low-privileged processes issuing LRPC or COM calls to Broadcast DVR interfaces from unusual parent processes
Review Sysmon event ID 1 (process create) and event ID 10 (process access) targeting Broadcast DVR service binaries

Monitoring Recommendations

Enable detailed audit policies for object access and privilege use on multi-user Windows hosts
Centralize endpoint telemetry so cross-session access patterns are visible to analysts
Alert on information disclosure patterns such as repeated enumeration of per-user profile data by a single low-privileged account

How to Mitigate CVE-2026-70148

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-70148 across all affected Windows builds
Prioritize patching on multi-user systems such as Remote Desktop Session Hosts and shared workstations
Audit local accounts and remove unnecessary interactive logon rights to reduce the pool of potential attackers

Patch Information

Microsoft released a security update addressing CVE-2026-70148 on October 13, 2026. The update corrects authorization checks within the Broadcast DVR User Service. Consult the Microsoft Security Update Guide for the KB numbers and build-specific packages that apply to your environment.

Workarounds

Disable the Broadcast DVR User Service (BcastDVRUserService) on systems that do not require Game Bar or broadcast capture features
Remove or restrict the Xbox Game Bar and related capture components on servers and enterprise desktops where they are not needed
Restrict local logon rights so that only trusted users can authenticate interactively to affected hosts

bash

# Disable the Broadcast DVR User Service via PowerShell (run as Administrator)
Get-Service -Name 'BcastDVRUserService*' | Stop-Service -Force
Get-Service -Name 'BcastDVRUserService*' | Set-Service -StartupType Disabled