Null pointer dereference in the Windows MIDI Service Module permits a local attacker with appropriate authorization to gain elevated privileges. The flaw enables unhandled dereference of a null pointer, which can lead to execution of code with higher privileges or system access. The primary impact is local privilege escalation, potentially compromising system integrity.

Affected are Microsoft Windows 11 24 H2, 25 H2, 26 H2, and 26 H1 editions, including arm64 and x64 builds as indicated in the CNA list.

The CVSS score of 7 classifies the issue as High severity. No EPSS score is available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an authorized user can trigger the null pointer dereference and raise their privileges. No remote exploitation path is described, so physical or authorized access is required.