Windows PrintWorkflowUserSvc CVE-2025-55691

Exploitation requires the attacker to already have local, authenticated low-privileged code execution on the target (PR:L, AV:L) - this is a local privilege-escalation primitive, not remotely reachable. The specific trigger is driving the Windows PrintWorkflowUserSvc (print workflow user service) to reach a use-after-free condition; this service is present by default on the affected Windows 11 24H2/25H2 and Windows Server 2025 builds, so no non-default feature toggle is implied by the description. The key limiting factor is high attack complexity (AC:H): successful exploitation depends on winning a race/timing window to reuse freed memory, which reduces reliability. No user interaction is required (UI:N).

This is a genuine but second-tier priority - a serious-impact flaw that is hard to exploit and shows no sign of active use. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) establishes the core profile: an authenticated local attacker (PR:L) with no user interaction can, if they win a difficult race/timing window (AC:H, typical of a use-after-free), gain full confidentiality, integrity and availability impact - consistent with elevating to SYSTEM. The exploitation-difficulty signals all point the same way and reinforce each other rather than conflict: EPSS is low at 0.32% (23rd percentile), there is no CISA KEV listing, and no public exploit code has been identified, so exploitation status is 'no public exploit identified at time of analysis.' The high AC:H and the requirement for pre-existing local authenticated access substantially limit real-world risk despite the High C/I/A impact, meaning this is a credible privilege-escalation primitive (useful as a second stage after initial access) rather than a drive-by or wormable threat. No conflicting signals are present in the input; the only caveat is that no SSVC/automatable data was supplied, so automatability is unknown - though a race-condition UAF is generally not reliably automatable. Prioritize via normal Patch Tuesday cadence, raising urgency only if a reliable exploit emerges.

An attacker who already has a low-privileged foothold on a Windows 11 (24H2/25H2) or Windows Server 2025 host runs code that repeatedly drives the PrintWorkflowUserSvc service to trigger and win a use-after-free race condition on a freed object. Successful exploitation corrupts memory in the service's context to execute attacker code at elevated (SYSTEM) privileges. No public proof-of-concept or active exploitation is known, and the high attack complexity (race window) makes reliable exploitation non-trivial.