CVE-2026-78464 Overview
CVE-2026-78464 is a time-of-check time-of-use (TOCTOU) race condition [CWE-367] in the Windows MIDI Service Module. An authorized local attacker who wins the race can elevate privileges on affected Windows 11 systems. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).
The flaw affects Windows 11 versions 24H2, 25H2, and 26H1 on both x64 and ARM64 architectures. Exploitation requires local access and low privileges, and no user interaction is needed. Successful exploitation yields high impact to confidentiality, integrity, and availability.
Critical Impact
A local, authenticated attacker who wins a TOCTOU race in the Windows MIDI Service can gain elevated privileges, providing a path from a standard user context to SYSTEM-level code execution.
Affected Products
- Microsoft Windows 11 24H2 (x64 and ARM64)
- Microsoft Windows 11 25H2 (x64 and ARM64)
- Microsoft Windows 11 26H1 (x64 and ARM64)
Discovery Timeline
- 2026-09-08 - CVE-2026-78464 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78464
Vulnerability Analysis
The Windows MIDI Service Module handles Musical Instrument Digital Interface (MIDI) device communication as a privileged system service. The service validates a resource, object, or permission state at one point in time and then acts on that state later. Between those two operations, an attacker with local access can modify the underlying resource so that the service operates on attacker-controlled data with elevated rights.
This class of flaw [CWE-367] is characteristic of race conditions in kernel-mode and service-mode components that share resources with lower-privileged callers. The attack complexity is rated high because the attacker must reliably win a narrow timing window between the check and the use. Successful exploitation delivers full compromise of the local system.
Root Cause
The root cause is non-atomic handling of a security-relevant resource inside the Windows MIDI Service Module. The service performs a validation step and then uses the result of that check without holding a lock or otherwise preventing concurrent modification. An attacker running as a low-privileged user can substitute the validated resource, such as a handle, file path, or object reference, before the service consumes it.
Attack Vector
Exploitation requires local, authenticated access to the target Windows 11 host. The attacker triggers a MIDI service operation and concurrently mutates the shared resource to change its state after validation succeeds. The service then performs a privileged action on the attacker-controlled resource, which allows the attacker to execute code or write data in the security context of the service.
No public proof-of-concept exploit is listed for CVE-2026-78464 at the time of publication, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-78464
Indicators of Compromise
- Unexpected child processes spawned by the Windows MIDI Service (MidiSrv or related service host processes) running as SYSTEM.
- Creation of new privileged local accounts, scheduled tasks, or services shortly after MIDI-related API activity by a non-administrative user.
- Anomalous handle duplication or symbolic link creation by low-privileged processes targeting MIDI service resources.
Detection Strategies
- Monitor for repeated, high-frequency calls into MIDI service APIs from a single non-admin user session, which is consistent with race-window brute forcing.
- Alert on process integrity level transitions where a MIDI-related service performs file writes or process creation outside its normal baseline.
- Correlate service crashes or unexpected restarts of the MIDI Service Module with subsequent privilege escalation activity on the same host.
Monitoring Recommendations
- Enable Windows Security auditing for object access, process creation (Event ID 4688), and service state changes on affected Windows 11 endpoints.
- Baseline normal MIDI service behavior across the fleet and forward the telemetry to a centralized analytics platform for anomaly detection.
- Track missing patch state for CVE-2026-78464 through vulnerability management tooling and prioritize hosts where standard users run untrusted code.
How to Mitigate CVE-2026-78464
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows 11 24H2, 25H2, and 26H1 systems.
- Restrict interactive and remote local logon rights to trusted administrators where operationally feasible.
- Inventory endpoints for local user accounts that can run untrusted code and prioritize those systems for patch deployment.
Patch Information
Microsoft has released security updates addressing CVE-2026-78464. Consult the Microsoft Security Update Guide for the specific knowledge base article and package identifiers for each affected Windows 11 build (24H2, 25H2, 26H1) on x64 and ARM64.
Workarounds
- No official vendor workaround is published; patching is the supported remediation.
- Where the MIDI Service Module is not required, evaluate disabling or restricting access to reduce the local attack surface until the patch is applied.
- Apply the principle of least privilege and application control policies (such as Windows Defender Application Control) to limit which binaries low-privileged users can execute.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
