CVE-2026-26166Patch(microsoft / windows_11_23h2)

LOWCVSS 7.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft windows_11_23h2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166

Weakness type (CWE)

CWE-415

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-04-17); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

microsoft

Products

windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2022windows_server_2022_23h2windows_server_2025

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Patch

250.0%

Disclosure

250.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	1	Patch1
2026-04-17	2	Disclosure2
2026-04-25	1	Patch1

Full discourse4 posts

Giuseppe Paternicola@giuseppe_1337166d
Patch
🚨 HIGH: CVE-2026-26166 (CVSS 7.0) Double free vulnerability in Windows Shell enables local privilege escalation by authenticated attackers. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #DFIR https://t.co/rDoIK5m0I2
Post summary
The tweet announces CVE‑2026‑26166, a double‑free Windows Shell flaw that allows local privilege escalation, and urges users to apply a patch immediately.
0000051
25 followersView on X
Infoflowcloud@infoflowcloud174d
Disclosure
🚨*CVE* CVE-2026-26166 Double free in Windows Shell allows an authorized attacker to elevate privileges locally. https://www.cve.org/CVERecord?id=CVE-2026-26166 ----- Traducción: CVE-2026-26166 Doble liberación de memoria en el Shell de Windows permite a un atacante autorizad… http://infoflow.cloud`
Post summary
The post announces CVE-2026-26166, a double free vulnerability in Windows Shell that enables local privilege escalation, but provides no Proof of Concept, exploit code, active exploitation evidence, or patch information.
0000032
71 followersView on X
CVE@CVEnew174d
Disclosure
CVE-2026-26166 Double free in Windows Shell allows an authorized attacker to elevate privileges locally. https://www.cve.org/CVERecord?id=CVE-2026-26166
Post summary
The post announces CVE-2026-26166, identifying it as a double‑free vulnerability in Windows Shell that can lead to local privilege escalation, but does not provide PoC, exploit code, or patch information.
00000157
57.2K followersView on X
WindowsForum@windowsforum177d
Patch
🪟 CVE-2026-26166 is a Shell EoP—aka “user can become admin” in the most Windows way possible. Patch fast or your security model is just fan fiction. https://windowsforum.com/threads/cve-2026-26166-windows-shell-eop-why-admins-must-patch-fast.412666/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #EndpointSecurity #WindowsShell #PrivilegeEscalation #Cve202626166 https://t.co/De6T5v8234
Post summary
The post highlights CVE-2026-26166 as a privilege‑escalation flaw that permits users to gain administrative rights on Windows, urging a rapid patch to mitigate the risk.
0000027
1.1K followersView on X

CPE platform detail11 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

11 of 11 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2022_23h2	-	-	-
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_11_23h2 vulnerabilities

What researchers are saying

CVE-2026-26166

Giuseppe Paternicola[verified]@giuseppe_1337Patch

The tweet announces CVE‑2026‑26166, a double‑free Windows Shell flaw that allows local privilege escalation, and urges users to apply a patch immediately.

WindowsForum[verified]@windowsforumPatch

The post highlights CVE-2026-26166 as a privilege‑escalation flaw that permits users to gain administrative rights on Windows, urging a rapid patch to mitigate the risk.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-26166, a double free vulnerability in Windows Shell that enables local privilege escalation, but provides no Proof of Concept, exploit code, active exploitation evidence, or patch information.

CVE@CVEnewDisclosure

The post announces CVE-2026-26166, identifying it as a double‑free vulnerability in Windows Shell that can lead to local privilege escalation, but does not provide PoC, exploit code, or patch information.