CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Windows Print Spooler Elevation of Privilege Vulnerability
AnalysisAI
Windows Print Spooler allows local privilege escalation that was exploited by the Russian GRU's 'Forest Blizzard' (APT28) group using a custom tool called 'GooseEgg' for credential theft and lateral movement in government networks.
Technical ContextAI
The Print Spooler vulnerability allows a local attacker to escalate privileges through crafted interactions with the printer driver installation process. APT28's GooseEgg tool automates exploitation and post-exploitation credential extraction.
Affected ProductsAI
Microsoft Windows (Print Spooler component)
RemediationAI
Apply Microsoft security update. Disable the Print Spooler service on systems that don't require printing. Monitor for GooseEgg indicators of compromise. Implement credential guard to protect LSASS.
Share
External POC / Exploit Code
Leaving vuln.today