A heap-based buffer overflow in the Windows MIDI Service Module allows an authorized local user to elevate privileges. The overflow can be exploited to execute arbitrary code with higher rights, enabling the attacker to perform privileged operations on the system.

Microsoft Windows 11 versions 24H2, 25H2, 26H1 and 26H2 on ARM64 and x64 platforms are affected. The vulnerability targets the MIDI service module included in these releases.

The CVSS score of 7.8 indicates a high risk level for local authenticated attackers. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is local, requiring the attacker to have permissions to interact with the MIDI service or to invoke the vulnerable module.