Windows Now Playing EUVD-2026-99957

Requires an attacker to already have local, authenticated low-privilege code execution on the target host (PR:L, AV:L) - this cannot be reached remotely or over the network. Exploitation specifically targets the Windows Now Playing Session Manager component, so the vulnerable media-session code path must be reachable in the running session. The key LIMITING factor is high attack complexity (AC:H): as a use-after-free, success depends on winning a non-deterministic timing/race window to reclaim the freed object, which CISA SSVC marks as not automatable. No user interaction is needed (UI:N). Default configurations of all supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2016-2025 builds below the patched versions are affected; applying the referenced Microsoft update removes the condition.

This is a moderate-priority local privilege escalation (CWE-416 use-after-free) in the Windows Now Playing Session Manager, rated CVSS 7.0. The signals are internally consistent and point AWAY from urgent, widespread exploitation despite the ubiquitous platform. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already be a local, authenticated (low-privilege) user and must win a difficult race/condition (AC:H) typical of use-after-free bugs. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale), though Technical Impact=total (full SYSTEM-level compromise if successful). There is no CISA KEV listing and no public POC, so this is NOT actively exploited. The high Technical Impact (total) and C:H/I:H/A:H scores show a successful exploit yields complete local takeover, but the combination of local-only access, high attack complexity, and required prior authentication keeps real-world risk measured rather than critical. No conflicting signals were found; EPSS was not provided in the input. Treat as a standard Patch-Tuesday-class EoP: patch in normal cycles, prioritizing multi-user and shared/terminal-server hosts where untrusted low-privilege users run code.

A low-privileged authenticated user (or malware already running in a limited user context) executes a crafted local process that races the Now Playing Session Manager to trigger the use-after-free, corrupting freed memory to hijack execution flow and elevate to SYSTEM. No user interaction is required, but the attacker must already have a foothold on the machine and reliably win a timing-sensitive race (AC:H). No public exploit code was identified at the time of analysis.