Windows PrintWorkflowUserSvc CVE-2025-55688

Exploitation requires the attacker to already be a locally authenticated, low-privileged user (PR:L) on an affected host running the PrintWorkflowUserSvc service, which backs the modern Windows print workflow stack. The attacker must drive print-workflow operations that cause an object to be freed and then reused, and because this is a use-after-free with AC:H, success depends on reliably winning a race window or controlling heap allocation state - a meaningful limiting factor that reduces reliability and rules out one-shot remote exploitation. Limiting factors: no remote network vector (AV:L), prior local access needed, no user interaction of a victim required (UI:N), and only Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 are listed as affected.

This is a genuine but moderate-priority elevation-of-privilege flaw rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local attack by an already-authenticated low-privileged user, requiring high attack complexity - consistent with a use-after-free (CWE-416) that likely depends on winning a race or grooming heap state in the PrintWorkflowUserSvc service. Impact is severe once achieved (C:H/I:H/A:H), indicating full SYSTEM-level compromise on success. The exploitation signals are notably low: EPSS is only 0.32% (23rd percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. No signals conflict: low EPSS, absent KEV, and the AC:H prerequisite all point the same direction - a real local privilege-escalation bug that is unlikely to see opportunistic mass exploitation and would more plausibly be chained by a determined attacker who already has code execution. The only data caveat is that reconnaissance is limited to a single Microsoft MSRC advisory reference; exact patched build numbers and technical root-cause detail are not provided in the input and should be confirmed via the MSRC update guide.

An attacker who already has low-privileged code execution on a Windows 11 24H2/25H2 or Windows Server 2025 host (e.g., via phishing or a prior foothold) triggers a use-after-free in the PrintWorkflowUserSvc service by manipulating print-workflow operations to free and then reuse a memory object. Because AC:H applies, the attacker must reliably win a timing/race or heap-grooming condition, after which they execute code in the service's context to elevate to SYSTEM. No public exploit code is identified at time of analysis, so weaponization would require independent development.