CVE-2026-85938: Windows Broadcast DVR Information Leak

CVE-2026-85938 is an information disclosure vulnerability in Windows Broadcast DVR User Service caused by improper access control. Authorized attackers can exploit this locally to access sensitive data. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-85938 Overview

CVE-2026-85938 is an improper access control vulnerability in the Windows Broadcast DVR User Service. An authorized local attacker can exploit the flaw to disclose information from the affected host. The weakness maps to [CWE-862] Missing Authorization, where the service fails to enforce access checks on protected resources.

Exploitation requires local access and low privileges, with no user interaction. Successful exploitation impacts confidentiality but not integrity or availability. Microsoft published the advisory in its Security Update Guide.

Critical Impact
An authenticated local attacker can read sensitive information handled by the Windows Broadcast DVR User Service, enabling further reconnaissance and lateral movement within the host.

Affected Products

Microsoft Windows (Broadcast DVR User Service component)
Refer to the Microsoft Security Update Guide for the full list of affected builds
Systems with the Broadcast DVR User Service enabled

Discovery Timeline

2026-10-13 - CVE-2026-85938 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85938

Vulnerability Analysis

The Windows Broadcast DVR User Service handles game and media capture functionality for interactive user sessions. The service exposes resources that should be restricted to privileged callers but lacks adequate authorization enforcement. A local attacker with a valid user account can interact with the service to retrieve data that should remain protected.

The disclosure is limited to information available to the service's context. Attackers typically chain information disclosure flaws with privilege escalation or credential theft to broaden impact.

Root Cause

The root cause is a missing authorization check [CWE-862]. The Broadcast DVR User Service does not verify whether the calling principal has permission to access certain resources before returning data. This design flaw permits a lower-privileged caller to read content intended for higher-privileged contexts.

Attack Vector

Exploitation is local. The attacker must be authenticated on the target system with at least standard user privileges. No user interaction is required. The attacker calls into the Broadcast DVR User Service and retrieves information that should be inaccessible from their session.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability reflects a low near-term likelihood of exploitation.

Technical specifics have not been disclosed by Microsoft. See the Microsoft Security Update Guide for vendor details.

Detection Methods for CVE-2026-85938

Indicators of Compromise

Unexpected process activity invoking BcastDVRUserService or related Broadcast DVR components from non-interactive sessions
Standard user accounts enumerating or querying DVR service endpoints outside normal gaming or capture workflows
Access attempts to Broadcast DVR resources from accounts with no history of using Xbox Game Bar or related features

Detection Strategies

Baseline normal usage of the Broadcast DVR User Service across endpoints and alert on deviations from that baseline
Correlate local authentication events with subsequent access to user service IPC endpoints to identify suspicious call patterns
Use endpoint detection and response telemetry to flag process trees where low-privilege processes interact with Broadcast DVR service handles

Monitoring Recommendations

Enable Windows audit policies for object access and service control manager events
Forward endpoint telemetry to a centralized analytics platform for cross-host correlation
Monitor for repeated access failures followed by successful calls, which may indicate enumeration attempts

How to Mitigate CVE-2026-85938

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build
Inventory endpoints that have the Broadcast DVR User Service enabled and prioritize patching for shared or multi-user systems
Restrict interactive logon on servers and sensitive workstations to limit the local attack surface

Patch Information

Microsoft has published guidance in the Security Update Guide for CVE-2026-85938. Administrators should deploy the vendor-supplied cumulative update through Windows Update, WSUS, Microsoft Intune, or their preferred patch management tooling. Validate the update against the Knowledge Base article listed in the advisory for the specific Windows version in use.

Workarounds

Disable the Broadcast DVR User Service on systems that do not require game or screen capture functionality
Enforce least privilege and remove unnecessary local accounts to reduce the pool of potential attackers
Apply application control policies to limit which binaries can interact with the service on hardened endpoints

bash

# Disable the Broadcast DVR User Service via PowerShell (run as Administrator)
Get-Service -Name "BcastDVRUserService*" | Stop-Service -Force
Get-Service -Name "BcastDVRUserService*" | Set-Service -StartupType Disabled