Windows: Use-after-free in Now Playing Session Manager (privilege escalation)

Summary

A use-after-free vulnerability in the Windows Now Playing Session Manager component allows an authorized local attacker to elevate privileges. The attacker needs local access and low privileges, and the CVSS vector rates the attack complexity as high, so the flaw is not directly reachable from the internet. The highest risk is on multi-user systems such as terminal servers and shared workstations, where users already hold valid accounts.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5761)
• Note: the CPE data lists only Windows 10 1607, so check the NVD configuration.

Fixed in

• Windows 10 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2022: 10.0.20348.5761
• Unknown: KB article numbers and exact release dates. Windows Server 2025 is not in the CNA record; one secondary source gives 10.0.26100.33650, which is not verified.

Workaround

Unknown. No workaround or mitigation was found in the checked sources; the Microsoft security update is the named remediation.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS score 0.00286.
• No public proof of concept found in a limited search (not confirmed absent).
• One unverified blog post states that the flaw was not publicly disclosed before the fix.

Our recommendation

• Install the Microsoft security update for the affected builds in the regular patch cycle, and patch multi-user systems, terminal/RDP servers and older unpatched builds first.
• Check whether Windows 10 1607, Windows Server 2016 and other listed systems are still supported or covered by extended security updates.
• Verify the affected products and KB numbers on the MSRC page before rollout.
• Restrict local logon to trusted users and monitor for unexpected privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83701 msrc.microsoft.com
• OpenCVE: CVE-2026-83701 app.opencve.io
• Vulners CVE list record: CVE-2026-83701 vulners.com
• Vulners NVD record: CVE-2026-83701 vulners.com
• Strix: CVE-2026-83701 (secondary mirror, partly unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:31.