Windows MIDI Service CVE-2026-69339

Exploitation requires an authenticated local user account (any standard user, not just administrator) on a Windows 11 system running an affected build of 24H2, 25H2, or 26H1. The Windows MIDI Service (MidiSrv) must be running, which is its default state on Windows 11. No network access, no user interaction from a victim, and no special application installation are required beyond the low-privileged local session. Exploitation is limited by the requirement for prior local access - this cannot be exploited remotely or anonymously. The impact is confined to confidentiality; no data modification or system disruption results directly from exploiting this flaw.

CVSS 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a realistic threat posture: exploitation is strictly local, requires only a standard user account, and yields no write or denial-of-service capability. The C:H rating indicates the exposed information is significant - potentially enabling privilege escalation chains if combined with other vulnerabilities - but there is no standalone code execution or integrity impact. No EPSS data was provided; without KEV listing or publicly available exploit code, this is assessed as low-urgency for most environments unless targeted insider threat or post-compromise lateral movement is a concern. The limited scope to Windows 11 versions 24H2/25H2/26H1 means legacy or enterprise Windows 10 fleets are unaffected. The attack complexity is genuinely low once local access is achieved, so the risk is meaningful in multi-user or shared workstation environments.

A threat actor who has already obtained a low-privileged local account - for instance via phishing or credential theft - runs a crafted application that queries the Windows MIDI Service for state information, receiving sensitive system data outside the authorized scope. This information could include internal handles or memory pointers that facilitate further privilege escalation. No public exploit code is known to exist at time of analysis.