Executive brief
The Windows MIDI (Musical Instrument Digital Interface) Service Module contains a heap-based buffer overflow vulnerability. An authorized user on a system could exploit this flaw to execute code with elevated privileges, potentially gaining administrative control over the affected computer.
Technical details
The vulnerability is a heap-based buffer overflow in the Windows MIDI Service Module. The flaw allows an authorized local attacker to corrupt heap memory and achieve privilege escalation. Attack preconditions require local system access and valid user credentials. Successful exploitation enables arbitrary code execution in the context of the MIDI service, typically running with elevated privileges. A patch is available from Microsoft via the Security Update Guide.
Affected products
- Microsoft Windows
Timeline
- 2026-09-08: disclosed
- 2026-09-08: advisory