Windows MIDI Service EUVD-2026-99977

Requires the attacker to already possess authenticated low-privileged local code execution on the Windows 11 host (PR:L, AV:L) and to interact with the Windows MIDI Service Module to trigger the use-after-free. The HIGH attack complexity (AC:H) indicates a race or timing-dependent condition that the attacker must win, limiting reliability and ruling out trivial one-shot exploitation. No user interaction is needed (UI:N). The flaw is not remotely reachable and cannot be triggered by an unauthenticated attacker; exploitation is gated behind prior foothold on the system. Patched builds (e.g., 10.0.26100.9711 for 24H2) are not affected.

This is a credible but not top-priority elevation-of-privilege flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a locally-exploitable, already-authenticated attack with HIGH attack complexity - meaning the attacker needs existing low-privileged code execution on the host and must win a non-trivial condition (typical of a use-after-free race) rather than firing a reliable one-shot exploit. The CISA SSVC framework reinforces a lower urgency: Exploitation=none (no observed exploitation), Automatable=no (consistent with AC:H and local-only access), while Technical Impact=total aligns with the C:H/I:H/A:H full-SYSTEM compromise if the race is won. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation - this is a high-impact-but-constrained-reachability issue, not an internet-facing emergency. The practical risk is as a post-compromise privilege-escalation primitive (e.g., sandbox escape or local admin acquisition), which matters for defense-in-depth but ranks below unauthenticated remote flaws. No conflicting signals were found between the vector and description - both agree on local, authenticated exploitation.

An attacker who already has low-privileged code execution on a Windows 11 host (e.g., via a malicious app, logged-in user, or compromised service) interacts with the Windows MIDI Service Module to trigger a use-after-free and wins the resulting race condition to corrupt memory. Successful exploitation yields SYSTEM-level privileges, enabling full local compromise. No public exploit identified at time of analysis, and the HIGH attack complexity means exploitation is not trivially reliable.