This vulnerability is a double free condition (CWE-415) in the Windows Shell component of Microsoft Windows 11 version 22H3 (build 10.0.22631.0). A double free occurs when the same memory is freed twice, potentially leading to memory corruption. An authorized attacker with local access can exploit this flaw to elevate their privileges, gaining higher-level access than intended. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this vulnerability.

Successful exploitation allows a local attacker with authorized access to elevate their privileges, potentially gaining administrative rights. This can lead to full system compromise, unauthorized access to sensitive data, and disruption of system operations. The vulnerability affects confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166 as soon as possible to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.