CVE-2026-71353: CWE-415: Double Free in Microsoft Windows 10 Version 1607

This vulnerability is a double free condition in the Windows Routing and Remote Access Service (RRAS) that can be exploited by an authorized local attacker to elevate privileges. The flaw exists in multiple Windows 10 versions, including builds starting from 10.0.14393.0 up to but excluding 10.0.14393.9512 and other specified build ranges. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this double free vulnerability in RRAS to elevate their privileges on the affected Windows 10 systems. This could lead to full system compromise, including unauthorized access to sensitive information and the ability to modify system settings or disrupt system availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-71353. No additional mitigation steps are required beyond applying the official patch.