This vulnerability is a use‑after‑free flaw in the Windows MIDI Service Module that allows an authorized local attacker to gain elevated privileges on a Windows 11 system. The weakness is classified as CWE‑416 and results in the attacker being able to execute code with higher privileges than intended by the operating system, potentially leading to full system compromise. The impact is limited to the scope of the local account that performed the malicious activity.

Microsoft Windows 11 is vulnerable in the 24H2, 25H2, 26H2, and 26H1 releases. Those installations running the Windows 11 version for ARM64 or x64 architectures are specifically affected. Only the listed versions are known to contain the flaw; all other Windows 11 variants are currently believed to be unaffected.

The CVSS score of 7 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet confirmed. The attack vector is local; an attacker must have authenticated or otherwise authorized access to the target system or device to trigger the use‑after‑free in the MIDI service. Once the flaw is exploited, elevated privileges are achieved, providing control over system resources and the potential to install malware, exfiltrate data, or disrupt services. Due to its local nature, security controls that enforce least privilege and proper code review of local services are critical in mitigating risk.