Windows Rich Edit CVE-2026-70093

Exploitation requires the attacker to already possess local, authenticated low-privileged access to the Windows host (PR:L), and to invoke the Rich Text Edit Control (riched20/msftedit, used by WordPad, Outlook, and many apps that render RTF) with attacker-controlled rich-text content to trigger the heap overflow. No special non-default configuration is named in the description and no user interaction is required (UI:N) once the attacker runs their payload. The primary limiting factors are the mandatory local foothold and existing authenticated access - there is no remote or unauthenticated path - and SSVC marks it not automatable, meaning it cannot be reliably mass-exploited. Patched builds per vendor remediate the issue.

This is a moderate-priority local privilege escalation, not a remote crisis. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local access and low-level privileges (an authenticated standard user), with low attack complexity and no user interaction once they are on the box. All three impacts are High (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating, meaning a successful exploit likely yields SYSTEM-level control. However, SSVC 'Exploitation: none' and 'Automatable: no' temper the urgency: there is no evidence of exploitation and the flaw cannot be sprayed/wormed. There is no CISA KEV listing and no public POC in the provided data, so this is a credible but not actively-exploited bug. All signals are internally consistent (local vector + total impact + not-automatable), so no conflicting data to reconcile - the realistic picture is a second-stage LPE useful to an attacker who already has a foothold, worth prioritizing in routine Patch Tuesday cycles rather than emergency patching.

An attacker who has already gained low-privileged access to a Windows host (via phishing, a prior exploit, or a compromised standard account) runs a crafted application or document that drives the Rich Text Edit Control to overflow a heap buffer. By grooming the heap and corrupting adjacent structures, they execute code in a higher-privilege context, escalating to SYSTEM. No public exploit code was identified at time of analysis.