The vulnerability is a use‑after‑free in the Windows Now Playing Session Manager that grants an authorized local attacker privilege escalation. The flaw arises when the session manager frees memory associated with a playing session and subsequent invalid accesses can be hijacked, allowing the attacker to execute code or modify system state. This classic Use After Free (CWE‑416) enables the attacker to gain administrative privileges and potentially compromise the entire system.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 for arm64‑based systems; and Microsoft Windows Server editions 2016, 2019, 2022, and 2025. All these builds are listed as vulnerable by Microsoft.

The CVSS score of 7 denotes high severity, yet the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating limited known exploitation. The attack requires a local, authorized user; there is no remote exploit vector indicated, and the exploitation likely necessitates user interaction with media playback. Consequently, the risk is significant for users with elevated privileges or those who run media services.