CVE-2026-26166 is a double free vulnerability (CWE-415) in the Windows Shell component of Microsoft Windows 11 version 22H3 (build 10.0.22631.0). The flaw allows a local attacker with some level of authorization to elevate privileges by exploiting improper memory management that leads to a double free condition. The vulnerability has a CVSS v3.1 base score of 7.0, indicating high severity. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized local attacker can exploit this double free vulnerability to elevate privileges on the affected Windows 11 system. This could lead to full system compromise depending on the privileges gained. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Microsoft has released an official fix for CVE-2026-26166. Users and administrators should apply the security update provided by Microsoft for Windows 11 version 22H3 (build 10.0.22631.0) to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.