CVE-2026-26179
Published: 14 April 2026
Summary
CVE-2026-26179 is a high-severity Double Free (CWE-415) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-26179 is a double free vulnerability (CWE-415) in the Windows Kernel that allows an authorized attacker to elevate privileges locally. Published on 2026-04-14T18:16:54.013, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.
A local attacker with low privileges (PR:L) can exploit this vulnerability through low-complexity attacks (AC:L) requiring no user interaction (UI:N). Successful exploitation enables privilege escalation, granting high-level access that compromises confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U).
The Microsoft Security Response Center provides details on mitigation and patches in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26179.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22420
Vulnerability details
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Double-free memory corruption in Windows Kernel directly enables local privilege escalation via exploitation of the flaw (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the kernel double free flaw through patching, comprehensively addressing the vulnerability.
Provides memory protections that mitigate exploitation of the double free vulnerability by preventing unauthorized memory modifications in the kernel.
Enforces least privilege for local accounts, limiting the attack surface and potential impact of privilege escalation from low-privilege contexts.