ZeroDay Findings
Sign inSign up

Findings

CVE-2026-66804

ZDI-26-617: Microsoft Windows MIDI Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Published Sep 8, 2026

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 8, 2026 · Catalog

    Detected

    This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.

Sources

  • CVE.orgCVE-2026-66804

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-66804

    30-day exploitation probability 0.3%

    first.org
  • Zero Day InitiativeZDI-26-617

    This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.

    zerodayinitiative.com