CVE-2026-23667: 
vulnerability analysis and mitigation

CVE-2026-23667 is a use-after-free vulnerability in the Windows Broadcast DVR component that allows an authorized attacker to elevate privileges locally. Disclosed on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday, it affects multiple versions of Windows 10 and Windows 11. Affected versions include Windows 10 1809, 21H2, and 22H2, as well as Windows 11 23H2, 24H2, 25H2, and 26H1. It carries a CVSS v3.1 base score of 7.0 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-416 (Use After Free), occurring within the Windows Broadcast DVR component when memory that has already been freed is subsequently accessed, potentially allowing an attacker to control program execution flow (Microsoft MSRC). Exploitation requires local access and a low-privileged user account; no user interaction is needed, but attack complexity is rated High, indicating that specific conditions or timing must be met to trigger the vulnerability. No public proof-of-concept code or technical write-ups detailing the precise exploitation mechanics have been published as of the time of disclosure (Feedly).

Successful exploitation allows an authenticated local attacker with low privileges to escalate to SYSTEM-level privileges on the affected Windows host. This could enable the attacker to install malware, modify system configurations, access sensitive data, create new privileged accounts, or disrupt system availability. The scope is limited to the local system, reducing the risk of direct remote exploitation, but it could serve as a critical step in a multi-stage attack chain following initial access (Microsoft MSRC).

Microsoft released patches on March 10, 2026, as part of the March 2026 Patch Tuesday security updates. Administrators should update affected systems to the following minimum build numbers: Windows 10 1809 → 10.0.17763.8511, Windows 10 21H2 → 10.0.19044.7058, Windows 10 22H2 → 10.0.19045.7058, Windows 11 23H2 → 10.0.22631.6783, Windows 11 24H2 → 10.0.26100.7979, Windows 11 25H2 → 10.0.26200.7979, and Windows 11 26H1 → 10.0.28000.1719. As additional hardening measures, organizations should enforce the principle of least privilege, restrict local user account access where possible, and monitor for unexpected privilege escalation events (Microsoft MSRC).

Coverage of CVE-2026-23667 was primarily in the context of the broader March 2026 Patch Tuesday release, which addressed 79 vulnerabilities including two zero-days. Security outlets such as BleepingComputer, Rapid7, Sophos, and the SANS Internet Storm Center covered the monthly update without singling out this specific CVE for notable commentary (Rapid7 Blog, Sophos Blog, SANS ISC). The Zero Day Initiative also published a March 2026 security update review that included this vulnerability among the month's disclosures (ZDI Blog).