Windows MIDI Service CVE-2026-62688

The attacker must hold an existing low-privileged (standard user) account on the target system, as confirmed by PR:L and AV:L in the CVSS vector - remote unauthenticated exploitation is not possible. No user interaction is required (UI:N) once the attacker's local session is established. The Windows MIDI Service Module must be running (its default state on Windows 11 consumer and enterprise installs); if the service is disabled, the attack surface is eliminated. Exploitation is limited to Windows 11 versions 24H2, 25H2, and 26H1 prior to their respective patched builds; no non-default configuration is stated as a prerequisite in the available data. Limiting factors: requires an existing local authenticated session, restricts attackers who have not yet gained any access to the endpoint, and is scoped exclusively to the three listed Windows 11 release channels.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H positions this as a high-severity local privilege escalation with low attack complexity, making it a reliable second-stage capability for threat actors who have already obtained an initial foothold. No EPSS score was included in the provided intelligence, preventing a quantitative exploitation probability estimate; no CISA KEV designation is present, and no public exploit code has been identified at time of analysis, so exploitation risk is currently inferred from CVSS metrics rather than observed activity. Despite the absence of confirmed exploitation, LPE vulnerabilities in default-running Windows system services are consistently weaponized in post-compromise intrusion chains - even a mid-sized municipal IT team in rybnik should treat this as urgent given Windows 11's broad enterprise footprint and the low barrier to exploitation once an attacker has any local access. The scope is bounded to Windows 11 (three release channels) and does not appear to affect Windows 10 or Server editions based on available data, which partially limits blast radius in mixed-OS environments.

An attacker who has gained a foothold on a Windows 11 system - via phishing, credential theft, or exploitation of a separate vulnerability - uses their low-privileged local account to send a specially crafted payload to the Windows MIDI Service Module, triggering the heap buffer overflow. By controlling the heap corruption, the attacker overwrites critical data structures or function pointers to redirect the service's execution into attacker-controlled shellcode, achieving SYSTEM-level code execution. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates that exploitation does not require a precise race condition or complex environment setup.