CVE-2026-32170: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-32170 Overview

CVE-2026-32170 is a double free vulnerability [CWE-415] in the Windows Rich Text Edit Control that allows an authorized local attacker to elevate privileges. The flaw affects a broad range of Microsoft Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and from Windows Server 2012 through Windows Server 2025. Successful exploitation can yield high impact to confidentiality, integrity, and availability. The attack requires local access, low privileges, and user interaction, and Microsoft has issued a security update tracked under the Microsoft Security Update CVE-2026-32170 advisory.

Critical Impact
An authorized attacker with local access can free the same memory region twice in the Rich Text Edit Control, corrupting heap metadata to execute code in an elevated context.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-05-12 - CVE-2026-32170 published to the National Vulnerability Database
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-32170

Vulnerability Analysis

The vulnerability is a double free condition in the Windows Rich Text Edit Control, the component that renders and edits RTF content inside Windows applications and dialogs. When the control processes specific sequences of formatting operations, an internal allocation can be released and a subsequent code path releases the same pointer a second time. Freeing the same chunk twice corrupts the user-mode heap allocator's free lists, allowing an attacker to manipulate subsequent allocations.

An authorized local attacker can leverage this corruption to overlap controlled data with a freed object that the control later dereferences. The result is an elevation of privilege within the context of the targeted process. The EPSS score for this CVE is 0.053%, indicating low predicted exploitation activity at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper lifetime management of a dynamically allocated buffer used by the Rich Text Edit Control. Two distinct cleanup paths release the same pointer without clearing the reference after the first free(), satisfying the conditions for [CWE-415: Double Free]. The unsynchronized release allows the heap allocator to return the same chunk to multiple callers.

Attack Vector

Exploitation is local and requires user interaction, such as opening or interacting with crafted rich-text content rendered by a vulnerable application. The attacker must already hold low-privileged authenticated access to the target host. Attack complexity is high because the attacker must win a timing-sensitive heap layout to convert the double free into a controlled write that escalates privileges.

No public proof-of-concept exploit code is currently available, and no entry exists in Exploit-DB for this CVE. See the Microsoft Security Update CVE-2026-32170 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-32170

Indicators of Compromise

Unexpected crashes or Watson error reports referencing riched20.dll or msftedit.dll in user-mode application logs.
New child processes spawned by document viewers, email clients, or chat applications that load the Rich Text Edit Control.
Token elevation events (Event ID 4672) followed by sensitive operations originating from a process that recently rendered RTF content.

Detection Strategies

Monitor for heap corruption telemetry, including STATUS_HEAP_CORRUPTION (0xC0000374) exceptions in processes that consume rich-text input.
Correlate user-interaction events with subsequent privilege changes on the same host within a short time window.
Hunt for anomalous loads of riched20.dll by processes that do not normally render rich text.

Monitoring Recommendations

Forward Windows Application and Security logs to a centralized SIEM for cross-host correlation of crash and elevation events.
Enable Windows Defender Exploit Guard with PageHeap or Fault Tolerant Heap diagnostics on high-value endpoints to surface double-free patterns.
Track patch deployment status across affected Windows 10, Windows 11, and Windows Server builds to identify exposed hosts.

How to Mitigate CVE-2026-32170

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-32170 advisory to all affected Windows clients and servers.
Prioritize remediation on multi-user systems such as terminal servers, jump hosts, and shared workstations where local low-privileged accounts exist.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of users who can trigger the flaw.

Patch Information

Microsoft has released cumulative security updates that address CVE-2026-32170 across all supported Windows 10, Windows 11, and Windows Server versions enumerated in the affected products list. Administrators should consult the Microsoft Security Update CVE-2026-32170 page for the specific KB articles applicable to each build and deploy through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Restrict execution of untrusted rich-text content by configuring application policies that disable RTF rendering where feasible.
Apply Attack Surface Reduction rules to block Office and mail clients from launching child processes after handling rich content.
Enforce least privilege so that interactive users cannot leverage local elevation to reach SYSTEM-level resources.

bash

# Configuration example: verify the Windows security update is installed
Get-HotFix | Where-Object { $_.HotFixID -match 'KB' } | Sort-Object InstalledOn -Descending