Windows PrintWorkflowUserSvc CVE-2025-55689

Requires the attacker to already have an authenticated, interactive low-privileged local session on the target Windows host (PR:L, AV:L) - there is no remote or network-triggerable path. Exploitation depends on driving the PrintWorkflowUserSvc (print workflow) service into a use-after-free and then winning a timing/race window, reflected by AC:H, which makes reliable exploitation difficult and may require multiple attempts. No user interaction is needed (UI:N). The print workflow service is present by default across the affected Windows 10 21H2/22H2, Windows 11 22H2-25H2, and Windows Server 2022/2023H2/2025 editions, so no special non-default configuration is required beyond standard Windows deployment. Limiting factors: prior local access, high timing complexity, and the inherently non-deterministic nature of the race.

This is a genuine but second-tier priority. The CVSS vector (AV:L/AC:H/PR:L/UI:N) describes a local privilege-escalation flaw: the attacker must already have a foothold as an authenticated low-privileged user on the host, and the AC:H signals a race/timing-dependent use-after-free that is non-trivial to win reliably. The impact triad (C:H/I:H/A:H) reflects full SYSTEM-level compromise once exploitation succeeds, which is why the base score reaches 7.0 (High). Corroborating signals point AWAY from urgency: EPSS is only 0.35% (27th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code was identified in the provided data - so there is no evidence of active or imminent widespread exploitation. There is no SSVC decision data in the input to evaluate automatability or exploitation status independently. Net: a credible local EOP primitive useful as a post-compromise step in a chain, but not a drop-everything remote threat. One minor inconsistency to verify: the input Tags include 'Denial Of Service' while the description and CWE-416 frame this strictly as privilege elevation - the DoS characterization is plausible as a secondary memory-corruption outcome but is not stated by the description.

A low-privileged user (or malware already running in a standard user context) on a Windows endpoint triggers a crafted sequence of print-workflow operations to drive PrintWorkflowUserSvc into a use-after-free state, then wins the timing race to reclaim the freed object and redirect execution, elevating to SYSTEM. Because AV:L/PR:L, this requires prior local code execution and is realistic chiefly as a post-exploitation privilege-escalation step. No public proof-of-concept was identified at time of analysis, and the high attack complexity (AC:H) makes reliable exploitation harder.