Executive brief
Windows MIDI Service is a core system component that manages audio input and output through MIDI (Musical Instrument Digital Interface) devices. A stack-based buffer overflow vulnerability allows an attacker with local system access to execute arbitrary code with elevated privileges, potentially leading to complete system compromise and unauthorized access to sensitive data.
Technical details
A stack-based buffer overflow exists in the Windows MIDI Service Module, triggered by improper input validation when processing MIDI messages or device commands. The vulnerability requires local access and authorization to trigger, making it suitable for privilege escalation attacks from low-privileged user contexts. An attacker can overflow a stack buffer with malicious data to overwrite return addresses and execute arbitrary code in the context of the MIDI service (typically SYSTEM or a privileged user account). Patches are available from Microsoft.
Affected products
- Microsoft Windows Affected versions not specified in advisory
Timeline
- 2026-09-08: disclosed