Windows PrintWorkflowUserSvc CVE-2025-55684

Exploitation requires the attacker to already possess a low-privileged authenticated local session on the target (PR:L, AV:L) and to interact with the Windows PrintWorkflowUserSvc print-workflow service to trigger the use-after-free. The limiting factor is high attack complexity (AC:H): the flaw is a memory-corruption race condition that demands winning a timing window, making reliable exploitation difficult and non-automatable. There is no remote network path and no user interaction by a second victim is required; the primary constraint is the need for prior local access plus precise race timing against the service.

This is a legitimate but moderate-priority elevation-of-privilege flaw rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) is internally consistent and signals a local-only vulnerability requiring the attacker to already hold low-privilege authenticated access, with high attack complexity - characteristic of a use-after-free (CWE-416) race condition that must win a timing window to be exploited reliably. The intelligence signals align rather than conflict: EPSS is low at 0.32% (23rd percentile), there is no CISA KEV listing, and no public exploit code was identified, all of which agree with the AC:H/AV:L profile pointing to difficult, local, non-automatable exploitation. No SSVC decision data was supplied. The one caveat is that the 'Denial Of Service' tag sits oddly against a vulnerability the vendor explicitly describes as privilege elevation; the A:H impact does make resource-disruption plausible as a secondary outcome, so treat this as an EoP primarily. Overall: a credible post-compromise local escalation vector worth patching on a normal cycle, but not evidence of widespread or imminent attack.

An attacker who already has a low-privileged authenticated foothold on a Windows 11 24H2/25H2 or Windows Server 2025 host interacts with the PrintWorkflowUserSvc to trigger a use-after-free, racing to reuse the freed object and corrupt memory in the service's context. Successfully winning the race lets them execute code at elevated privilege, moving from a standard user to SYSTEM-level control. No public proof-of-concept exists at time of analysis, and the high attack complexity means reliable exploitation requires precise timing.