CVE-2026-70567: CWE-415: Double Free in Microsoft Windows 11 Version 24H2

This vulnerability is a double free condition in the Windows Display Enhancement Service component of Microsoft Windows 11 Version 24H2. A double free occurs when the same memory is freed twice, which can lead to memory corruption and potentially allow an attacker with local authorized access to elevate privileges. The affected versions include builds >=10.0.26100.0 and <10.0.26100.9445, >=10.0.26200.0 and <10.0.26200.9445, >=10.0.28000.0 and <10.0.28000.2954, and >=10.0.26100.0 and <10.0.26100.33438. The vulnerability has a CVSS v3.1 score of 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this double free vulnerability to elevate privileges on the affected Windows 11 Version 24H2 systems. Successful exploitation could lead to full system compromise, affecting confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the latest security updates for Windows 11 Version 24H2 as provided by Microsoft in their security update guide. No additional mitigation steps are indicated beyond applying the official patch.