Double free in Windows Rich Text Edit allows an authorized user to gain higher privileges locally, potentially enabling escalation to administrative levels. The flaw is a classic memory management issue (CWE-415) where freed memory is inadvertently accessed again, corrupting program state and permitting control flow hijacking. If successfully exploited, the attacker could execute arbitrary code or modify system configurations without user consent.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 editions.

The CVSS score of 6.7 indicates moderate severity, but the lack of an EPSS rating means current exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access and sufficient rights to launch software that loads the vulnerable Rich Text Edit component. Once executed, the double free can lead to privilege escalation or arbitrary code execution. The risk is elevated for systems that run applications embedding Rich Text Edit and for accounts with higher privileges.