CVE-2026-32170

What it actually does

CVE-2026-32170 is a local privilege-escalation vulnerability caused by a double-free memory corruption condition in the Windows Rich Text Edit component. An authenticated local attacker who can trigger vulnerable rich-text parsing or editing behavior may corrupt process memory and potentially gain code execution in a more privileged security context. Successful exploitation could allow escalation from a low-privileged account to administrative or SYSTEM-level privileges, depending on the process context in which the vulnerable component is invoked. The CVSS vector indicates local access, low privileges required, user interaction required, high attack complexity, and high confidentiality, integrity, and availability impact after exploitation.

Why it matters to the business

If exploited, this vulnerability can let an attacker who already has limited access to a Windows workstation or server gain much broader control. That can enable credential theft, security tool tampering, persistence, lateral movement, data access, and ransomware staging. It is not currently listed in CISA KEV, has no reported mature public exploit, and has a low EPSS score with no upward trend over the last 30 days, so broad opportunistic exploitation appears unlikely at this time. However, because the affected products include many supported Windows client and server versions, it should still be treated as an important patching item, especially on shared workstations, jump hosts, terminal servers, developer systems, and servers where local users or exposed application workflows can process rich-text content.

How an attack unfolds

An attacker first needs authenticated local access or the ability to execute code as a low-privileged user on an affected Windows system. The attacker then causes a vulnerable application or Windows component that uses Rich Text Edit functionality to process specially crafted rich-text content or perform a sequence of rich-text editing operations that triggers the double-free condition. Because the same memory object is released more than once, the attacker attempts to manipulate heap layout so the freed memory is reused in a controlled way. If the heap corruption is shaped successfully, execution flow or security-sensitive memory structures may be altered, allowing attacker-controlled code to run in the context of the vulnerable process. If that process runs with elevated privileges, or if the exploit can target a privileged workflow, the attacker can elevate privileges and then disable protections, dump credentials, create privileged accounts, install persistence, or move laterally. The high attack complexity and required user interaction mean exploitation is less straightforward than a remote unauthenticated bug, but it remains valuable as a post-compromise privilege-escalation primitive.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no exact fixed build numbers were provided in the input, use the vendor’s security update guidance for CVE-2026-32170 and ensure systems have installed the cumulative Windows update released on or after the May 2026 security update cycle that includes this fix. Prioritize systems where untrusted users can log on locally or interactively, systems used for administration, remote desktop/session hosts, and servers that process user-supplied rich-text content. Where immediate patching is not possible, reduce risk by limiting local logon rights, restricting interactive access to servers, enforcing least privilege, blocking execution from user-writable directories, hardening endpoint detection and response policy, and monitoring for application crashes or suspicious child processes from rich-text-capable applications. Mitigations should be considered temporary; patching is the required remediation.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows endpoints have installed the applicable Microsoft cumulative security update containing the fix for CVE-2026-32170. Validate through centralized patch management, Windows Update history, installed hotfix inventory, or vulnerability scanning that maps installed OS build and update level to Microsoft’s fixed release. Re-scan representative Windows 10, Windows 11, and Windows Server assets after deployment to ensure the vulnerability is no longer reported. For systems that could not be patched, validate compensating controls by confirming local logon restrictions, least-privilege enforcement, application control policy, and monitoring coverage. Review crash telemetry after patching to ensure suspicious Rich Text Edit-related application faults do not continue on updated systems.

Typical attack path

1. Gain initial low-privileged access to an affected Windows client or server through phishing, stolen credentials, malware execution, or another vulnerability.
2. Identify whether the host is running a vulnerable Windows version and whether relevant Rich Text Edit components are present and unpatched.
3. Prepare crafted rich-text content or an exploit harness that triggers the double-free condition in the Windows Rich Text Edit component.
4. Induce the required local/user interaction or execute the vulnerable parsing/editing workflow from the low-privileged account.
5. Manipulate heap state to turn the double free into controlled memory corruption rather than a simple application crash.
6. Achieve code execution or security-context manipulation in a higher-privileged process context.
7. Use elevated privileges to perform follow-on actions such as credential dumping, persistence, defense evasion, lateral movement, or ransomware deployment.

How to detect it

There is no single reliable network indicator for this local memory-corruption vulnerability, and exploitation may leave only endpoint artifacts. Review endpoint telemetry, Windows Error Reporting, application logs, EDR alerts, and Sysmon data for unusual crashes in applications that load Windows Rich Text Edit libraries, especially crashes involving heap corruption or access violations followed by privilege-sensitive activity. Useful Windows sources include Application event logs, Windows Error Reporting events, Security logs for account and privilege changes, Sysmon process creation and image load events, EDR memory-corruption detections, and service creation logs. Look for exception codes such as 0xc0000374 heap corruption and 0xc0000005 access violation in processes loading msftedit.dll, riched20.dll, or riched32.dll. Correlate crashes with subsequent suspicious events, including unexpected child processes, creation of local administrators, new services, scheduled tasks, LSASS access, security tool tampering, or command execution from user-writable directories. Because this vulnerability requires local access and user interaction, detection should focus on suspicious endpoint behavior rather than perimeter traffic. No named threat actors or campaigns are currently associated with this CVE in the supplied intelligence.

• msftedit.dll
• riched20.dll
• riched32.dll
• Exception code: 0xc0000374
• Exception code: 0xc0000005
• A heap has been corrupted
• Faulting module name: msftedit.dll
• Faulting module name: riched20.dll
• Faulting module name: riched32.dll
• WerFault.exe
• Event ID 1000
• Event ID 1001
• The process terminated unexpectedly
• cmd.exe /c whoami /priv
• net localgroup administrators
• sc.exe create
• schtasks.exe /create

What your security team should do

• Patch affected Windows clients and servers with the Microsoft cumulative update that includes the fix, prioritizing administrative workstations, shared systems, remote desktop/session hosts, and servers with interactive user access.
• Use vulnerability management tooling to identify all affected Windows versions and track remediation to completion across both workstation and server fleets.
• Treat this as a post-compromise privilege-escalation risk: prioritize hosts where a low-privileged foothold would create high business impact, such as identity, management, build, and file-service systems.
• Hunt for recent crashes involving Rich Text Edit-related modules such as msftedit.dll, riched20.dll, and riched32.dll, especially where followed by privilege escalation, new service creation, suspicious process spawning, or credential access behavior.
• Monitor for low-privileged users spawning administrative tools, modifying services, disabling security controls, or accessing credential material after rich-text-capable application crashes.
• Apply least privilege and restrict local/interactive logon rights on servers to reduce exploitability while patching is underway.
• Because EPSS is low, stable, and there is no KEV listing or known mature exploit, use risk-based prioritization rather than emergency response unless exploit code or active exploitation emerges.