CVE-2026-26163
Published: 14 April 2026
Summary
CVE-2026-26163 is a high-severity Double Free (CWE-415) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-26163 is a double free vulnerability in the Windows Kernel, classified under CWE-415. It affects the Windows operating system kernel component and was published on 2026-04-14. The vulnerability has a CVSS v3.1 base score of 7.8, reflecting high severity due to its potential for significant impact.
An authorized local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation allows elevation of privileges, granting high confidentiality (C:H), integrity (I:H), and availability (A:H) impacts within the unchanged security scope (S:U).
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26163 provides details on patches and mitigation guidance for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22390
Vulnerability details
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Double-free memory corruption in Windows kernel directly enables local privilege escalation from low-privileged context to full system control (C/I/A high), matching T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the double-free vulnerability in the Windows Kernel by requiring timely application of vendor patches as advised by MSRC.
Provides memory protections such as ASLR and DEP that mitigate exploitation of double-free vulnerabilities in the kernel.
Enables vulnerability scanning to identify the presence of CVE-2026-26163 in Windows Kernel components prior to exploitation.