What is the CVSS score of EUVD-2026-22394?

EUVD-2026-22394 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by EUVD-2026-22394?

CVE-2026-26166 is a local privilege escalation vulnerability in Windows Shell affecting Windows 11 and Server 2022/2025 that allows authenticated users with low privileges to gain SYSTEM-level access…. A patch is available.

How to fix or mitigate EUVD-2026-22394?

Within 24 hours: Identify all Windows 11 (22H3-26H1) and Windows Server 2022/2025 systems in your environment and verify current patch status. Within 7 days: Deploy vendor-released patches to all affected systems-prioritize domain controllers, critical servers, and systems with elevated access requirements first. Within 30 days: Complete patch deployment across all remaining Windows 11 and Server 2022/2025 assets and validate remediation through security scanning.

Microsoft EUVD-2026-22394

| CVE-2026-26166 HIGH

Double Free (CWE-415)

2026-04-14 microsoft

Information Disclosure Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:13 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22394

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.0

DescriptionCVE.org

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Shell via double-free memory corruption allows low-privileged authenticated users to gain SYSTEM-level access across Windows 11 (versions 22H3 through 26H1) and Windows Server 2022/2025 environments. The CWE-415 double-free vulnerability requires high attack complexity but no user interaction, enabling complete system compromise once exploited. Vendor-released patches are available with specific build numbers identified for each affected version. No public exploit identified at time of analysis, though the CVSS 7.0 score reflects significant impact potential when successfully exploited.

Technical ContextAI

This vulnerability stems from a CWE-415 double-free condition in the Windows Shell component, a core operating system subsystem responsible for the Windows user interface, file management, and process interaction. A double-free occurs when memory is deallocated twice, creating exploitable memory corruption that can lead to arbitrary code execution. The affected CPE strings identify multiple Windows 11 releases (22H3, 23H2, 24H2, 25H2, 26H1) and Windows Server editions (2022, 2022 23H2 Server Core, 2025, 2025 Server Core), all running build versions prior to their respective patched releases. The Windows Shell's privileged execution context makes this an ideal target for elevation attacks, as successful exploitation allows attackers to break out of low-privilege user contexts into SYSTEM-level access. The high attack complexity (AC:H) suggests the vulnerability requires precise timing, memory layout knowledge, or specific system conditions to reliably trigger the double-free and achieve code execution.

RemediationAI

Apply the vendor-released patches from Microsoft's April 2026 security updates immediately, upgrading to the following minimum build versions: Windows 11 22H3/23H2 to build 10.0.22631.6936 or later, Windows 11 24H2 to build 10.0.26100.32690 or later, Windows 11 25H2 to build 10.0.26200.8246 or later, Windows 11 26H1 to build 10.0.28000.1836 or later, Windows Server 2022 to build 10.0.20348.5020 or later, Windows Server 2022 23H2 Server Core to build 10.0.25398.2274 or later, and Windows Server 2025 (all editions) to build 10.0.26100.32690 or later. Deploy patches through standard Windows Update channels, WSUS, or Configuration Manager. Refer to the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166 for detailed installation guidance. No workarounds are identified; patching is the only complete mitigation. Prioritize systems with multiple user accounts, terminal servers, and environments where privilege boundaries are security-critical.