Windows Now Playing EUVD-2026-99335

Exploitation requires the attacker to already hold authenticated, interactive local access to the Windows host (CVSS PR:L) and the ability to run arbitrary code or interact with the Now Playing Session Manager component; it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing or environmental conditions apply once local access exists. The primary limiting factor is the local-access prerequisite: this is a privilege-escalation primitive usable only after an initial compromise or by a legitimate low-privileged local user, not an entry-point vulnerability. The Now Playing Session Manager is a default Windows component, so no non-default configuration is required on affected builds.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 7.8) in the Windows Now Playing Session Manager. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates an attacker must already have authenticated low-privilege local access, with low attack complexity and no user interaction once that foothold exists. Impact is total (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating and typical of a use-after-free (CWE-416) that yields SYSTEM-level code execution. Countervailing signals keep this below top-tier urgency: it is NOT listed in CISA KEV, SSVC rates Exploitation as 'none' and Automatable as 'no' (local EoP cannot be auto-propagated), no EPSS score was provided in the input, and no POC is referenced. The absence of EPSS data is a gap - exploitation probability could not be quantified. Net assessment: a genuine post-compromise privilege-escalation building block (valuable as a second-stage primitive after initial access), but not an internet-facing, wormable, or currently-exploited emergency. Prioritize via normal Patch Tuesday cadence, expedited on systems where untrusted users hold interactive local sessions.

An attacker who has already gained a low-privileged foothold on a Windows host - e.g., via phishing, a standard user account, or a prior RCE - runs a crafted local program that manipulates the Now Playing Session Manager to trigger a use-after-free. By grooming the freed object, the attacker achieves code execution in a privileged context and escalates to SYSTEM. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a working exploit, once written, would be reliable.