CVE-2026-32069
Published: 14 April 2026
Summary
CVE-2026-32069 is a high-severity Double Free (CWE-415) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-32069 is a double free vulnerability (CWE-415) in the Windows Projected File System, published on 2026-04-14. It affects Windows systems that utilize this file system component for projecting file system views, such as in virtual file systems or certain development environments.
The vulnerability can be exploited by an authorized local attacker with low privileges (PR:L). Exploitation requires low attack complexity (AC:L) and occurs with no user interaction (UI:N), enabling local privilege escalation. Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 score of 7.8 and unchanged scope (S:U).
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32069.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22491
Vulnerability details
Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Double-free memory corruption in a Windows kernel/user-mode file system component directly enables local privilege escalation from low-privileged context with no user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, prioritization, and timely patching of the double free vulnerability in Windows Projected File System as specified in the MSRC advisory.
Provides memory protection mechanisms such as non-executable memory and randomization that mitigate exploitation of the double free for local privilege escalation.
Enforces least privilege to restrict the low-privilege local attacker's ability to leverage the double free for high-impact privilege escalation.