Windows MIDI Service CVE-2026-68842

Exploitation requires an authenticated local session on the target Windows 11 machine with at minimum standard user (low-privilege) access - confirmed by the CVSS vector PR:L. No user interaction from a second party is required (UI:N), and attack complexity is low (AC:L), meaning no race condition or special timing is needed. The vulnerability is strictly local (AV:L); remote exploitation over a network is not possible. Only Windows 11 versions 24H2, 25H2, and 26H1 are listed as affected - other Windows versions are not in scope per available data. Impact is limited entirely to confidentiality; neither system integrity nor availability is affected. The specific class of sensitive information exposed by the MIDI Service is not detailed in available descriptions.

The CVSS score of 5.5 (Medium) accurately captures the bounded nature of this vulnerability: the attack requires an established local session with at least low-level privileges, ruling out remote exploitation. EPSS data is not provided in available sources, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. No POC is publicly known. Even a mid-sized municipal IT team in tczew should treat this as a standard patch-cycle item rather than an emergency response trigger, given that an attacker must already possess a foothold on the target machine. The C:H metric suggests the disclosed data may be meaningfully sensitive once obtained, but the local-only vector and PR:L requirement significantly constrain real-world attacker reach. SSVC assessment: exploitation status unconfirmed, not easily automatable (requires local access), technical impact is partial (confidentiality only). Priority is routine patching rather than emergency response.

A standard local user account on an unpatched Windows 11 system runs a crafted application or script that interfaces with the Windows MIDI Service Module, triggering the improper information boundary condition described by CWE-497. The service returns sensitive system data beyond what the caller is authorized to receive, and the attacker reads this information to inform further lateral movement or privilege escalation attempts. No public exploit code is known, but the low attack complexity (AC:L) means exploitation would be straightforward for an attacker who understands the service interface.