CVE-2026-88079: Windows MIDI Service Module Elevation of Privileges Vulnerability
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
Other sources
Windows MIDI Service Module Elevation of Privileges Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Microsoft Windows 11 with the Windows MIDI Service Module present are in scope. Exploitation requires local access and authorization, so it is not described as remotely exploitable.
What access does an attacker need to exploit it?
An attacker must already be an authorized local user with low privileges. No user interaction is required according to the supplied severity vector.
What is the potential impact if exploitation succeeds?
A successful exploit can elevate the attacker's privileges locally. The provided vector indicates high potential impact to confidentiality, integrity, and availability.