Windows MIDI Service EUVD-2026-100082

Exploitation requires an attacker to already possess authenticated local access with at least low privileges (PR:L) on an affected Windows 11 host - this is not remotely reachable (AV:L) and requires no user interaction (UI:N). The specific trigger is interaction with the Windows MIDI Service Module in a manner that induces a null pointer dereference (CWE-476); the high attack complexity (AC:H) indicates a non-deterministic or race/timing-sensitive condition that an attacker cannot reliably force on the first attempt, which materially limits real-world exploitability. Affected configurations are default installations of Windows 11 versions 24H2 (builds before 10.0.26100.9711), 25H2 (before 10.0.26200.9711), 26H1 (before 10.0.28000.3231), and 26H2 (before 10.0.26300.9711); patched builds are not vulnerable.

This is a moderate-priority local elevation-of-privilege flaw, not an urgent internet-facing emergency. The CVSS 3.1 base score of 7.0 is driven by full impact (C:H/I:H/A:H) but tempered by a local-only attack vector (AV:L), high attack complexity (AC:H), and a requirement for existing low privileges (PR:L) - meaning an attacker must already have authenticated access to the host and win a difficult-to-trigger condition (consistent with a null-pointer-dereference race). CISA's SSVC framework aligns with a lower-urgency reading: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited), though Technical Impact=total. EPSS was not provided in the input, and the CVE is not in CISA KEV; there is no public exploit identified. The signals are mutually consistent - a genuinely-impactful-but-hard-to-exploit local EoP - rather than conflicting. One notable inconsistency to verify: the vulnerability is tagged 'Denial Of Service' and the CWE is CWE-476 (null pointer dereference, which typically yields availability-only impact), yet Microsoft classifies it as elevation of privilege with full C/I/A impact; defenders should treat Microsoft's EoP classification as authoritative but note the underlying bug class.

An attacker who already has a low-privileged authenticated session on a Windows 11 host (for example, a standard local user or a foothold from a prior compromise) interacts with the Windows MIDI Service in a way that triggers a null pointer dereference, winning a timing/complexity-dependent condition to corrupt execution flow and elevate to higher (likely SYSTEM) privileges. No user interaction is required and exploitation is entirely local. No public proof-of-concept or exploit code has been identified at time of analysis.