Windows MIDI Service CVE-2026-78464

Exploitation requires an authenticated low-privilege local account on the target Windows 11 system - the CVSS AV:L metric confirms remote unauthenticated exploitation is not possible. The MIDI Service must be in a running state; it is enabled by default on Windows 11 consumer editions and many enterprise configurations, so no non-default service enablement is needed. The AC:H metric reflects that the attacker must reliably win a precise scheduler timing window, which limits practical exploitation to targeted attacks using purpose-built race-loop tooling rather than opportunistic scripting. No specific application, hardware device, or non-default Windows feature flag is required beyond having interactive local logon access.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent: local-only attack surface and high complexity suppress the base score relative to network-reachable LPE bugs, while the full C:H/I:H/A:H triad accurately reflects that a successful race win yields SYSTEM-level access. The AC:H metric is the primary exploitation barrier - reliable race-condition exploitation against a service typically requires tool-assisted looping and favorable scheduler conditions, placing this firmly in the targeted-attacker category rather than commodity malware territory. No CISA KEV listing and no public proof-of-concept code exist at time of analysis, and EPSS data was not provided, but the absence of known exploitation further supports treating this as a standard Patch Tuesday priority rather than an emergency out-of-band response. The full impact metrics remain appropriate because privilege escalation from low-user to SYSTEM gives an attacker complete control over the host, including credential access, persistence mechanisms, and security tool tampering.

An attacker with a low-privilege domain or local account on a vulnerable Windows 11 workstation deploys a race-loop tool that rapidly opens and manipulates the MIDI Service's shared resource, iterating until the check-to-use window is won. Upon successfully exploiting the race, the attacker's code executes in the MIDI Service's elevated context, granting SYSTEM privileges. No public proof-of-concept has been identified at time of analysis, so reliable exploitation currently requires bespoke tooling and system-specific timing calibration.