Windows MIDI Service EUVD-2026-99373

Exploitation requires the attacker to already have authenticated local access with at least low-level privileges (PR:L) on an affected Windows 11 host, and the ability to interact with the Windows MIDI Service Module to deliver the malformed input that triggers the CWE-122 heap overflow. There is no network vector and no user interaction by a victim (UI:N) - the attacker acts directly. Limiting factors that reduce real-world risk: it is local-only (AV:L), so it cannot be exploited remotely or across the network; it presupposes an existing foothold; and it only affects the enumerated Windows 11 builds below the patched 10.0.x.9711/3231 versions, so patched or unaffected branches are not exploitable. No special non-default configuration is called out in the description, but the attacker must be able to reach the MIDI service interface.

This is a credible but not emergency-tier vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity attack requiring the attacker to already hold low-level privileges on the host, with total impact (C:H/I:H/A:H) consistent with a kernel/service privilege escalation - SSVC agrees, rating Technical Impact as 'total'. The mitigating signals dominate the risk picture: SSVC lists Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (local-only, so it cannot be mass-scanned or wormed), and there is no CISA KEV listing and no EPSS score supplied. No public exploit code is referenced. In short, the signals are internally consistent - a high-impact but access-gated local EoP that is a patch-management priority rather than a drop-everything incident. It is a classic second-stage tool: valuable to an attacker who has already achieved low-privilege code execution and wants SYSTEM, not an initial-access vector. EPSS is absent from the input and cannot be compared; if obtained it would very likely be low given the local vector and lack of exploitation.

An attacker who already has a low-privileged foothold on a Windows 11 machine (for example via phishing-delivered malware or a compromised standard user account) invokes the Windows MIDI Service with crafted input that overflows a heap buffer, corrupting memory to execute code in the service's higher-privilege context and gain SYSTEM. No public proof-of-concept is referenced, and because the attack vector is local it cannot be launched remotely or automated at scale.