A double free flaw in the Windows Shell permits an unauthorized network attacker to overwrite memory and execute arbitrary code. The vulnerability triggers when a malicious user sends a specially crafted command to the Shell, causing the internal free operation to be performed twice on the same memory block. This leads to a classic heap corruption that attackers can exploit to run code with the privileges of the Shell process, potentially escalating to system‑level control.

The flaw affects multiple Windows operating systems including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, across both standard and server‑core installations.

With a CVSS score of 8.8, this vulnerability is considered high severity, but the Exploit Prediction Scoring System score is currently unavailable. It is not listed in the CISA KEV catalog, suggesting no widespread public exploitation to date. The likely attack vector is remote network, requiring the attacker to locate a reachable Shell instance and craft a malicious payload. Although the required initial access could be difficult, once achieved the impact is severe, granting arbitrary code execution on the target machine.