Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authorized user (AV:L, PR:L) triggers a low-complexity double free with no interaction, yielding full SYSTEM-level compromise (C/I/A:H); no scope change as the driver runs in the same security authority.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Microsoft Printer Drivers subsystem, the Windows print-driver/spooler code path that historically runs with elevated (often SYSTEM-level) trust and has been a recurring source of local EoP bugs. The root cause is CWE-415 (Double Free): the same heap allocation is released twice, corrupting heap metadata or freelist state and enabling controlled reuse of freed memory. CPE data enumerates the affected products as Microsoft Windows clients (windows_10_version_1607, 1809, 21H2, 22H2; windows_11_version_24H2, 25H2, 26H1) and Windows Server (2012, 2012 R2 including Server Core, and per tags 2016/2019/2022/2025). Exploiting a double free of this class typically requires grooming the heap so the second free and subsequent allocation land on attacker-controlled data, allowing arbitrary write/execution in the higher-privileged driver context.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-55004 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55004, selecting the KB/build that matches each affected Windows client and Server SKU (including Server Core). Because this is a driver-level fix, deploy the update via normal Windows Update / WSUS / SCCM channels and reboot to complete installation. If patching must be deferred on a given host, reduce local attack surface as a compensating control: stop and disable the Print Spooler service (sc stop Spooler; sc config Spooler start=disabled) on systems that do not serve or use printing - this removes the exploitable path but breaks all local and network printing on that host; and tighten local account provisioning so untrusted users cannot obtain the interactive/low-privilege foothold the exploit requires. Verify workaround side effects against print-server roles before applying broadly.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44012
GHSA-vx5p-mmvv-8qvc