Microsoft Windows 11: Local privilege escalation in Windows MIDI Service Module
Summary
A use-after-free vulnerability in the Windows MIDI Service Module of Windows 11 allows an authorized local user to elevate privileges. Exploitation requires a local session with low privileges and high attack complexity. The vulnerability is not reachable from the internet.
Affected
- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
Fixed in
- Cumulative update KB5127648 (October 13, 2026) for 24H2, 25H2 and 26H2, which installs build 26100.9711 on 24H2
- 26H1: KB5127646 (version 10.0.28000.3231 or later per CNA data)
- Verify build numbers against the MSRC advisory before rollout.
Workaround
- Unknown. No vendor mitigation was found; patching is the documented remedy.
Exploitation
- CISA SSVC: Exploitation none, Automatable no.
- Not listed in CISA KEV according to a third-party aggregator (not verified directly).
- No public proof of concept found.
- No known exploitation in the wild.
Our recommendation
- Install the October 2026 cumulative update (KB5127648 or later) on all affected Windows 11 systems, prioritising shared, multi-user, RDS/AVD hosts.
- Plan the move off 24H2 Home and Pro, as KB5127648 is their last monthly update for that version; Enterprise and Education remain supported until October 12, 2027.
- Note the known Smart App Control issue in KB5127648 on 24H2.
- Restrict local user access on critical systems and monitor for suspicious privilege changes.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-83751 msrc.microsoft.com
- OpenCVE: CVE-2026-83751 app.opencve.io
- Vulners CVELIST: CVE-2026-83751 vulners.com
- Vulners NVD: CVE-2026-83751 vulners.com
- Pureinfotech: KB5127648 October 2026 update pureinfotech.com
- Notebookcheck: KB5127648 update www.notebookcheck.net
- HelpDeskGeek: KB5127648 Smart App Control known issue helpdeskgeek.com
- Strix: CVE-2026-83751 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:16.
Original description (NVD)
Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.