This vulnerability is a double free issue (CWE-415) in the Windows Win32K ICOMP component on Windows 11 version 23H2 (build 10.0.22631.0). It enables an authorized local attacker to elevate privileges by exploiting improper memory management. The CVSS 3.1 base score is 7.0, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, high attack complexity, and low privileges required. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights and control. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at the time of publication.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20863 to remediate this vulnerability.