This vulnerability is a double free condition (CWE-415) in the Windows Shell component of Microsoft Windows 11 version 22H3 (build 10.0.22631.0). An authorized attacker with local access and low privileges can exploit this flaw to elevate privileges, potentially gaining higher system rights. The CVSS v3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining administrative control or higher privileges on the affected Windows 11 system. This can lead to unauthorized access to sensitive information, system modification, or disruption of system availability. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166 as soon as possible to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.