Windows PrintWorkflowUserSvc CVE-2025-55690
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
ExploitTrigger use-after-free in PrintWorkflowUserSvc
-
ExecutionWin memory-reuse race window
-
ImpactExecute code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authorized local user context (PR:L) on a system running the Windows PrintWorkflowUserSvc, which handles print-workflow activity and is present by default on the affected Windows 11 24H2/25H2 and Server 2025 builds. Exploitation is a use-after-free that depends on winning a memory-reuse timing race (AC:H), so success is non-deterministic and typically needs many attempts. Limiting factors: no remote vector (local access is mandatory), prior authentication as at least a low-privileged user, and although no user interaction is required, the high-complexity race meaningfully reduces real-world reliability. |
| Impact | Signals point to a real but second-tier priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local, authenticated attack requiring high complexity to win a use-after-free race window, yielding full C:H/I:H/A:H impact (SYSTEM-level). This is a classic local privilege escalation. EPSS is low at 0.34% (26th percentile), there is no CISA KEV listing and no public exploit identified, which is consistent with the AC:H rating that makes reliable exploitation non-trivial. An SSVC-style reading: no observed exploitation, not readily automatable (local access plus a timing race), but total technical impact. The signals are internally consistent - no network-vs-local or auth conflicts to flag - so this is a genuine LPE best treated as a post-compromise chain link, not a mass-exploited remote flaw. Prioritize it on normal Windows patch cadence rather than as an imminent threat. |
| Exploit ScenarioDerived | A low-privileged local user - or malware already running in a standard user context - repeatedly drives the Windows PrintWorkflowUserSvc to trigger the use-after-free, racing to reclaim the freed object with attacker-controlled memory. Winning the race corrupts the service's memory and leads to code execution with SYSTEM privileges, escalating from the initial foothold. No public exploit is identified at time of analysis, and the AC:H rating means the race is difficult to win reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Local privilege escalation in Windows PrintWorkflowUserSvc on Windows 11 24H2/25H2 and Windows Server 2025 arises from a use-after-free that an authorized low-privileged local user can trigger to gain higher integrity, confidentiality, and availability impact (CVSS 3.1 7.0, AV:L/AC:H/PR:L/UI:N). Exploitation depends on winning a memory-reuse timing race, making success non-deterministic and typically requiring repeated attempts; no public exploit identified at time of analysis, and EPSS is 0.34% (26th percentile).
RemediationAI
Apply the Microsoft security update identified in the MSRC update guide for CVE-2025-55690 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55690); the input does not provide an exact KB/build number, so verify the patched build for Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 in the vendor advisory. Because exploitation requires an authenticated local user and a high-complexity timing race, reduce exposure by limiting local logon and interactive access on sensitive systems to trusted users, accepting the operational cost of tighter role separation, and monitor for repeated PrintWorkflowUserSvc crashes, restarts, or unusual print-workflow activity as a detection signal. If print workflow functionality is not required, disabling or restricting the related service can reduce attack surface, but this may break printing and workflow features, so test before deployment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PrintWorkflowUserSvc is a Windows service component that supports print-workflow operations and is present by default on the affected Windows 11 24H2/25H2 and Windows Server 2025 builds. The root cause is CWE-416 use-after-free: a memory object is freed but later dereferenced, and because the flaw is reachable from a local user context, an attacker who already holds low-privileged access can attempt to shape heap reuse so that the stale pointer resolves to attacker-influenced data, potentially elevating privileges. The CVSS vector (AV:L/AC:H/PR:L/UI:N) confirms local access, low privileges, no user interaction, and high attack complexity, consistent with a race-dependent memory-corruption primitive rather than a deterministic remote exploit; the same corruption can also produce a crash/DoS, matching the memory-corruption/DoS tags. Affected CPEs cover microsoft:windows_11_24h2, microsoft:windows_11_25h2, and microsoft:windows_server_2025 with wildcard versions.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only use-after-free needing an authenticated user and a hard-to-win reuse race, hence AV:L/PR:L/AC:H; successful exploitation grants SYSTEM, so C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2025-55690 is an unpatched local privilege-escalation flaw in Windows PrintWorkflowUserSvc affecting Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Exploitation requires an authenticated local user and a timing-dependent memory-reuse race, and no public exploit has been identified at time of analysis, but a successful attack could allow a low-privileged user to gain higher system rights on affected endpoints and servers. Leadership should care because these are current-generation Windows platforms, no vendor-released patch is available, and mitigation currently depends on access restrictions and monitoring.
No vendor-released patch identified at time of analysis; interim controls include least-privilege enforcement, limiting local interactive logon to trusted users, monitoring for privilege-escalation attempts and PrintWorkflowUserSvc crashes, and applying vendor mitigations when published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
GitHub PoC
Exploit-DB