Windows Rich Text Edit EUVD-2026-29570

The attacker must already hold a valid, low-privileged local account on the target system (PR:L per CVSS vector - unauthenticated remote exploitation is not possible). A legitimate user - or the attacker themselves if they can trigger application behavior - must interact with malicious RTF content processed by the Rich Text Edit Control (UI:R). The high attack complexity (AC:H) requires that the attacker engineer specific heap layout conditions to reliably trigger and leverage the double free; this is a non-trivial constraint that limits practical exploitation to skilled adversaries. No non-default configuration of Windows is required beyond the standard presence of the RichEdit control, which is installed by default. Limiting factors for defenders: exploitation is strictly local-only (no network path), requires user interaction with attacker-supplied content, and the heap exploitation complexity imposes a high technical bar. Environments restricting local user account creation, enforcing application whitelisting, or blocking untrusted RTF content via policy have meaningfully reduced attack surface.

The CVSS base score of 6.7 (Medium) appropriately balances the total potential impact against the significant prerequisite constraints. The SSVC assessment - Exploitation: none, Automatable: no, Technical Impact: total - is internally coherent: while a successful exploit achieves full system compromise, the path to exploitation is gated by three compounding requirements: local authenticated access (PR:L), user interaction (UI:R), and high attack complexity (AC:H). The EPSS score of 0.05% at the 16th percentile is consistent with SSVC's 'none' exploitation status and reflects that this class of Windows heap memory corruption, while impactful if exploited, is not being actively leveraged in the current threat landscape. No public proof-of-concept exists to lower that bar. The breadth of affected products - over 20 distinct Windows OS versions and builds - increases aggregate exposure across enterprise environments, and Windows Server 2012/2012 R2 are at or near end-of-life, meaning some deployments may struggle to obtain or apply patches. Risk is real but not urgent outside environments where insider threat or post-initial-access lateral movement from low-privileged accounts is a modeled scenario. The 'Information Disclosure' tag conflicts with the privilege escalation description; teams should treat this as a local privilege escalation vulnerability for prioritization purposes.

A low-privileged local attacker places a crafted RTF document in a shared directory or sends it via an internal channel to a higher-privileged user. When the target opens the document in an application backed by the Windows Rich Text Edit Control - such as WordPad or a mail client rendering RTF - the malformed RTF triggers a double free, corrupting heap metadata in the vulnerable process. With sufficient heap manipulation, the attacker redirects execution and achieves elevated privileges on the local system. No public proof-of-concept has been identified, and the high attack complexity means reliable exploitation requires precise heap grooming techniques not trivially achievable by commodity tooling.