Vulnerability details
CVE-2026-88079
Microsoft Windows 11
Windows MIDI Service Module Elevation of Privileges Vulnerability
CVSS 3.1
7.0High
Official description
Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.0High | 3.1 | CVEProject cvelistV5 (CNA) (microsoft) | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 ≤ v < 10.0.26100.9711 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 ≤ v < 10.0.26200.9711 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 Version 26H2 | 10.0.26300.0 ≤ v < 10.0.26300.9711 | CVEProject cvelistV5 (CNA) |
| Microsoft | Windows 11 version 26H1 | 10.0.28000.0 ≤ v < 10.0.28000.3231 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88079 vendor-advisorypatch
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-13
- Last updated
- 2026-10-31
- State
- Published
- Assigner (CNA)
- microsoft
Exploit prediction (EPSS)
0.27%
Probability of exploitation in 30 days
20.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-476NULL Pointer Dereference