Microsoft Windows MIDI Service Module: Use after free allows local privilege escalation
Summary
A use-after-free weakness (CWE-416) in the Windows MIDI Service Module allows an authenticated local user to elevate privileges to a higher level on the affected system. The attack requires a valid low-privilege account and local access, and the attack complexity is rated high. Successful exploitation could give an attacker full control over confidentiality, integrity and availability on the host.
Affected
- Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974 (per third-party aggregator, not yet confirmed on MSRC)
Fixed in
- Windows 11 24H2: 10.0.26100.9974
- Windows 11 25H2: 10.0.26200.9974
- Windows 11 26H1: 10.0.28000.3501
- Windows 11 26H2: 10.0.26300.9974 (to be confirmed on MSRC)
- KB numbers per branch: Unknown.
Workaround
- Microsoft mitigation: Unknown.
- Where MIDI hardware is not used, disabling the Windows MIDI service may be an option to evaluate after testing business applications. This is not confirmed by Microsoft for this CVE.
Exploitation
- Exploited in the wild: No evidence found.
- CISA SSVC: Exploitation none, automatable no, technical impact total.
- Public proof of concept: None found; Unknown beyond that.
- KEV listing: Not listed according to a third-party tracker.
Our recommendation
- Install the November 2026 cumulative update for your Windows 11 branch once the KB is confirmed on the MSRC advisory.
- Where MIDI hardware is not used, consider disabling the MIDI service after testing.
- Review local administrator rights and shared accounts, as exploitation requires a local authenticated user.
- Prioritise multi-user systems such as shared PCs, terminal or RDP hosts.
- Recheck NVD and MSRC for analysis and exploitability updates.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-105574 msrc.microsoft.com
- CVE Record CVE-2026-105574 www.cve.org
- Strix AI: CVE-2026-105574 www.strix.ai
- Windows MIDI Services known issues and workarounds devblogs.microsoft.com
- Microsoft MIDI GitHub releases github.com
- SentinelOne: CVE-2026-56183 (related MIDI use-after-free) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:36.
Original description (NVD)
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.