This vulnerability (CVE-2026-21530) involves a double free condition in the Windows Rich Text Edit component used by Microsoft 365 Apps for Enterprise. Exploitation requires local authorized access and user interaction, with high complexity and privileges required. Successful exploitation could lead to elevation of privileges, impacting confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected version is 16.0.1.

An authorized local attacker who can interact with the vulnerable component may exploit this double free vulnerability to elevate their privileges on the affected system. This could result in full compromise of the affected application’s security context, impacting confidentiality, integrity, and availability of data and system resources.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the available patch as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530. Since this is a cloud-hosted service, Microsoft manages remediation server-side; verify that the environment is updated accordingly.