This vulnerability, identified as CVE-2026-26166 and classified under CWE-415 (Double Free), affects Microsoft Windows 11 version 22H3 (build 10.0.22631.0). It involves a double free condition in the Windows Shell, which can be leveraged by an authorized local attacker to gain elevated privileges. The CVSS v3.1 base score is 7.0, reflecting high severity with local attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized local attacker could exploit this double free vulnerability to elevate privileges, potentially gaining higher system rights than intended. This could lead to full system compromise, including unauthorized access to sensitive data and disruption of system availability.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security update provided by Microsoft for Windows 11 version 22H3 (build 10.0.22631.0) as soon as possible to remediate this issue. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166 for detailed patch information and installation instructions.