EUVD-2026-29570
GHSA-77q3-4vm7-hr7j
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Local-only vector with low-privilege requirement and mandatory user interaction; AC:H reflects heap-exploitation complexity; full C/I/A impact consistent with local privilege escalation to SYSTEM.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.
Technical ContextAI
The Windows Rich Text Edit Control (RichEdit) is a built-in Windows system component that provides rich text formatting and rendering capability for RTF documents and is consumed by numerous applications including WordPad, legacy Office components, and third-party software. The root cause is CWE-415 (Double Free): when the same heap memory block is freed more than once, the heap allocator's internal metadata can become corrupted, enabling an attacker to influence subsequent memory allocations and potentially redirect code execution flow. Reliably exploiting double frees in modern heap implementations requires overcoming allocator mitigations, which explains the high attack complexity rating (AC:H). The vulnerability is confirmed across a wide CPE footprint - cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012 - and the EUVD version data (EUVD-2026-29570) provides specific build ceilings for each affected OS branch, ranging from the legacy 6.2.x kernel (Server 2012) through the 10.0.28000.x kernel (Windows 11 26H1). The local-only attack vector (AV:L) indicates the vulnerability is triggered through local process interaction with the RichEdit control rather than via a network-accessible service.
RemediationAI
Apply the vendor-released patches from Microsoft targeting the specific build ceilings confirmed by EUVD-2026-29570: upgrade Windows 10 1607 and Server 2016 to build 10.0.14393.9140 or later; Windows 10 1809 and Server 2019 to 10.0.17763.8755; Windows 10 21H2 to 10.0.19044.7291; Windows 10 22H2 to 10.0.19045.7291; Windows 11 22H3/23H2 to 10.0.22631.7079; Windows 11 24H2 to 10.0.26100.8457; Windows Server 2025 to 10.0.26100.32860; Windows 11 25H2 to 10.0.26200.8457; Windows 11 26H1 to 10.0.28000.2113; Server 2012 to 6.2.9200.26079; Server 2012 R2 to 6.3.9600.23181; and Server 2022 to 10.0.20348.5139. Consult the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32170 for associated KB identifiers. For systems where immediate patching is not feasible, a meaningful compensating control is to restrict exposure to untrusted RTF content: configure Microsoft Office and Outlook via Group Policy to block external RTF rendering, and limit placement of RTF files in locations accessible to low-privileged users. This reduces the user-interaction trigger surface but does not eliminate the underlying memory corruption; treat it as a temporary measure only. Windows Server 2012 and 2012 R2 are near or past end-of-extended-support - enroll in Extended Security Updates (ESU) or plan migration, as future patches may not be available without additional licensing.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today