CVE-2026-105574: Windows MIDI Service Module Elevation of Privileges Vulnerability

Q: Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 with the Windows MIDI Service Module present are in scope. Exploitation requires local access and an authorized attacker account with low privileges.

Q: Can this be exploited remotely or by an unauthenticated attacker?

The supplied vector indicates local attack access, low privileges required, and no user interaction. It does not indicate remote or unauthenticated exploitation.

Q: What could a successful attacker achieve?

A successful exploit could elevate the attacker’s privileges locally. The provided impact ratings indicate potential high impact to confidentiality, integrity, and availability.

Published Nov 10, 2026

Updated

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Other sources

Windows MIDI Service Module Elevation of Privileges Vulnerability

— Microsoft

Affected Software

8 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9974, >=10.0.26300<10.0.26300.9911

10.0.26300.997410.0.26300.9911

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H2, >=10.0.26300<10.0.26300.9974, >=10.0.26300<10.0.26300.9911

10.0.26300.997410.0.26300.9911

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9974, >=10.0.26200<10.0.26200.9911

10.0.26200.997410.0.26200.9911

Microsoft Windows 11=25H2, >=10.0.26200<10.0.26200.9974, >=10.0.26200<10.0.26200.9911

10.0.26200.997410.0.26200.9911

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9974, >=10.0.26100<10.0.26100.9911

10.0.26100.997410.0.26100.9911

Microsoft Windows 11=24H2, >=10.0.26100<10.0.26100.9974, >=10.0.26100<10.0.26100.9911

10.0.26100.997410.0.26100.9911

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9974Fixed in 10.0.26300.9911Patch KB5132043
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9974Fixed in 10.0.26200.9911Patch KB5132043
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9974Fixed in 10.0.26100.9911Patch KB5132043

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:19 PM

Data Sourced

via MITRE·06:19 PM

DescriptionSeverity

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 with the Windows MIDI Service Module present are in scope. Exploitation requires local access and an authorized attacker account with low privileges.

Can this be exploited remotely or by an unauthenticated attacker?

The supplied vector indicates local attack access, low privileges required, and no user interaction. It does not indicate remote or unauthenticated exploitation.

What could a successful attacker achieve?

A successful exploit could elevate the attacker’s privileges locally. The provided impact ratings indicate potential high impact to confidentiality, integrity, and availability.

CVE-2026-105574: Windows MIDI Service Module Elevation of Privileges Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

Can this be exploited remotely or by an unauthenticated attacker?

What could a successful attacker achieve?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

Can this be exploited remotely or by an unauthenticated attacker?

What could a successful attacker achieve?