Product:
Windows Rich Text Edit
Summary
A double free vulnerability in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. This can lead to unauthorized access and manipulation of system resources. The issue arises from improper memory management, which can be exploited under certain conditions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-21530 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and be able to interact with the Windows Rich Text Edit component. By carefully crafting input that triggers the double free condition, the attacker can manipulate memory allocation and gain elevated privileges, potentially leading to full control over the affected system.
Affected Products
- Windows Rich Text Edit: A component of Windows that allows users to edit rich text documents, which is vulnerable to privilege escalation due to improper memory handling.
Mitigation
To mitigate this vulnerability, users should ensure that they apply the latest security updates provided by Microsoft. Additionally, restricting local access to systems and monitoring for unusual activity can help reduce the risk of exploitation.