Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
An authorized attacker must send a victim a malicious and specially crafted file and convince them to open it.
Security updates
10.0.17763.8755 — https://support.microsoft.com/help/5087538
10.0.20348.5139 — https://support.microsoft.com/help/5087545
10.0.20348.5074 — https://support.microsoft.com/help/5087424
10.0.19044.7291 — https://support.microsoft.com/help/5087544
10.0.19045.7417 — https://support.microsoft.com/help/5094127
10.0.26100.32860 — https://support.microsoft.com/help/5087539
10.0.26100.32772 — https://support.microsoft.com/help/5087423
10.0.26200.8457 — https://support.microsoft.com/help/5089549
10.0.26200.8390 — https://support.microsoft.com/help/5089466
10.0.22631.7079 — https://support.microsoft.com/help/5087420
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.25398.2330 — https://support.microsoft.com/help/5087541
10.0.28000.2113 — https://support.microsoft.com/help/5089548
10.0.14393.9140 — https://support.microsoft.com/help/5087537
6.2.9200.26079 — https://support.microsoft.com/help/5087470
6.3.9600.23181 — https://support.microsoft.com/help/5087471
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5556.1000 — https://support.microsoft.com/help/5002578
Vulnerabilities 1
-
Medium 6.7
Windows Rich Text Edit Elevation of Privilege Vulnerability
Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
Revision history
-
#3
Added Office softwares to the Security Updates table. Customers that are running supported versions of Office are encouraged to update to the indicated versions to be protected from this vulnerability.
-
#2
Updated Hotpatch links. This is in informational change only.
-
#1
Information published.
References
-
CVE-2026-21530 Windows Rich Text Edit Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss