Product:
Windows Rich Text Edit Control
Summary
A double free vulnerability in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally. This can lead to unauthorized access and manipulation of system resources. The issue arises from improper memory management, which can be exploited under specific conditions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-32170 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and be able to interact with the Windows Rich Text Edit Control. By carefully crafting input that triggers the double free condition, the attacker can manipulate memory allocation and gain elevated privileges. This requires a high level of complexity and user interaction.
Affected Products
- Windows Rich Text Edit Control: A component that allows users to edit rich text documents, which is vulnerable to privilege escalation due to improper memory handling.
Mitigation
To mitigate this vulnerability, users should ensure that they apply the latest security updates provided by Microsoft. Additionally, restricting local access to systems and monitoring for unusual activity can help reduce the risk of exploitation.