This vulnerability involves a double free condition in the Windows Rich Text Edit component on Windows 10 Version 1607. A double free occurs when the same memory is freed twice, potentially leading to memory corruption and privilege escalation. The attacker must have local access with limited privileges and user interaction is required. The vulnerability is classified under CWE-415 (Double Free). Microsoft has published an official fix to remediate this issue.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher-level access on the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530 to remediate this vulnerability. No additional mitigation steps are specified by the vendor.