Windows MIDI Service EUVD-2026-99991

Exploitation requires the attacker to already hold a low-privileged, authenticated local session on the affected host (AV:L, PR:L) and to interact with the Windows MIDI Service Module component; no user interaction by a victim is needed (UI:N). The limiting factors are significant: the attacker cannot exploit this remotely and must first obtain local code/session access with valid credentials, which confines this to post-compromise or insider/standard-user scenarios rather than remote mass exploitation. Affected builds are Windows 11 versions 24H2 (<10.0.26100.9711), 25H2 (<10.0.26200.9711), 26H2 (<10.0.26300.9711), and 26H1 (<10.0.28000.3231); fully patched systems above these build numbers are not exploitable. No special non-default configuration is documented as a prerequisite.

This is a genuinely moderate, not high, priority. The CVSS 3.1 score of 5.5 is driven by high confidentiality impact (C:H) but is capped by a local attack vector (AV:L) and required privileges (PR:L), with no integrity or availability impact. All exploitation signals point the same direction and are mutually consistent: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', which aligns with an info-disclosure-only flaw. No EPSS score was provided in the input, the CVE is not on CISA KEV, and no POC was referenced - so there is no public exploit identified at time of analysis. The combination of local access, authenticated prerequisite, non-automatable exploitation, and no evidence of exploitation makes this a patch-in-normal-cycle item rather than an emergency, despite being a CWE-497 sensitive-information exposure. The main counterweight is prevalence: the affected product is Windows 11, which is ubiquitous, so even a low-urgency flaw affects an enormous installed base and should still be remediated via normal patch management.

An attacker who already has a low-privileged authenticated session on a Windows 11 host (e.g. a standard local user or a foothold from another compromise) interacts locally with the Windows MIDI Service Module to read sensitive system information that should be outside their control sphere. No public exploit code is identified, exploitation is not automatable per SSVC, and the outcome is information disclosure only - there is no code execution or integrity/availability impact.