CVE-2026-78464

Published: Sep 8, 2026Modified: Sep 10, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

Affected (6)

Products: Microsoft: Windows 11 24h2, Windows 11 25h2, Windows 11 26h1

3 products

Windows 11 24h2

Windows 11 25h2

Windows 11 26h1

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 11 24h2	Before 10.0.26100.9445
Microsoft Windows 11 24h2	Before 10.0.26100.9445
Microsoft Windows 11 25h2	Before 10.0.26200.9445
Microsoft Windows 11 25h2	Before 10.0.26200.9445
Microsoft Windows 11 26h1	Before 10.0.28000.2954
Microsoft Windows 11 26h1	Before 10.0.28000.2954

Related CWEs

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78464

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.