Windows MIDI Service CVE-2026-62693

Exploitation requires an attacker to possess a low-privileged local or domain user account with the ability to interactively log on to the target system (CVSS PR:L, AV:L confirmed). The Windows MIDI Service must be running - it is enabled by default on Windows 11 but may be disabled in hardened or server-role deployments. Attack complexity is High (AC:H), meaning the attacker must successfully win a timing race against concurrent service operations, which is non-deterministic and typically requires repeated looped attempts; success rates vary with CPU load and thread scheduling. Exploitation is bounded to: Windows 11 versions 24H2, 25H2, and 26H1 running unpatched builds; systems where the attacker has an established local session (interactive, RDP, or equivalent); and environments where the MIDI Service is active. Pure network-based attackers without any local foothold cannot exploit this vulnerability. No user interaction by a privileged user is required once the attacker has their low-privileged session.

The CVSS 7.0 score captures meaningful risk but must be contextualized by operational signals. The local attack vector (AV:L) is the primary risk limiter - remote-only threat actors cannot directly trigger this without prior foothold. The High attack complexity (AC:H) further reduces exploitability, as race condition exploitation is non-trivial and success rates vary with system load and scheduler behavior. Low privilege requirement (PR:L) means any standard domain or local user account is a sufficient starting position, increasing relevance in shared-access environments such as RDP servers, VDI deployments, and enterprise workstations. Impact metrics are uniformly High (C:H/I:H/A:H), indicating full system compromise is achievable upon winning the race. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The 'Information Disclosure' tag alongside privilege escalation likely reflects secondary data exfiltration capability once elevated access is obtained, rather than a standalone information leak. Risk is moderate-to-high for environments with untrusted or semi-trusted local users and lower for tightly managed single-user workstations with no interactive user sharing.

A low-privileged domain or local user on a shared Windows 11 RDP server runs a crafted multi-threaded tool that hammers the MIDI Service with concurrent requests, repeatedly racing to substitute a privileged object reference within the service's shared resource before the integrity check completes. After winning the race - which may require many iterations depending on system scheduling - the attacker's thread gains execution in an elevated integrity context, yielding SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis, but race condition exploitation is a well-understood technique requiring no novel research to weaponize once the vulnerable code path is identified.