A use‑after‑free flaw in Windows Now Playing Session Manager allows an authorized local attacker to gain elevated privileges. The weakness stems from improper memory handling that lets code execute with system rights, corresponding to CWE‑416. The impact is confined to the privileges of an authenticated user who can then compromise the local system.

The vulnerability affects multiple Windows releases: Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; and Windows Server 2019 (including Server Core), 2022, and 2025. All of these platforms lack the fix until the latest Microsoft update that addresses CVE‑2026‑83700 is applied. The affected builds span x86, x64, and arm64 architectures as indicated by the CPE entries.

The CVSS score of 7.8 signals a high‑severity vulnerability, but the EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog. This suggests no confirmed exploit yet, yet an attacker with local access can trigger the flaw by causing the Now Playing Session Manager to free a handle and then reuse it. Because the attack requires user context, it is most relevant to systems where non‑administrator users can run applications or open media files.