An unchecked double free vulnerability exists in the Windows Rich Text Edit control, allowing a local attacker to corrupt memory and elevate privileges. By exploiting the flaw, an attacker who can run or control the rendering of malicious Rich Text Format documents can obtain higher rights on the host machine, potentially leading to full system takeover. The weakness corresponds to CWE-415, involving improper deallocation of heap resources.

The flaw impacts a range of Microsoft Windows operating systems: Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. All affected editions contain the vulnerable Rich Text Edit control.

The CVSS score of 6.7 reflects moderate severity. No EPSS value is published, indicating limited publicly available evidence of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local access and the ability to trigger the Rich Text Edit rendering, so the attack vector is local via crafted RTF files. Exploitation requires that the attacker successfully induces a double free, leading to memory corruption and privilege escalation.