CVE-2026-21530 is a double free vulnerability (CWE-415) in the Windows Rich Text Edit component used by Microsoft 365 Apps for Enterprise. This vulnerability allows an authorized local attacker to elevate privileges by exploiting improper memory management leading to a double free condition. The CVSS 3.1 base score is 6.7, reflecting medium severity with high attack complexity and requiring user interaction. Microsoft has published an official fix and manages remediation for this cloud service. The affected version explicitly stated is 16.0.1.

An authorized local attacker can exploit this vulnerability to elevate privileges, potentially gaining higher access rights on the affected system. The vulnerability impacts confidentiality, integrity, and availability with high impact ratings. However, exploitation requires local access, high attack complexity, and user interaction, limiting the ease of exploitation.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530 to mitigate this vulnerability.