Microsoft Windows CVE-2026-55004

Requires local, authenticated access: the attacker must already run code as a low-privileged user on the target host (CVSS PR:L, AV:L), so this cannot be launched remotely or unauthenticated. The vulnerable component is Microsoft Printer Drivers, which implies the print driver/spooler stack must be present and reachable to the calling user - a condition met by default on Windows client and server installations that have printing components enabled. Limiting factors: exploitation demands an existing foothold and successful heap manipulation of a freed allocation; there is no user-interaction requirement (UI:N) and complexity is low (AC:L), so once a local foothold exists there are few additional barriers. Disabling the Print Spooler removes the exposure on hosts that do not need printing.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a locally-exploitable, low-complexity flaw requiring low privileges and no user interaction, with full CIA impact but no scope change - a classic local EoP profile rather than a remote-facing emergency. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation probability cannot be quantified; per the precision rules this is 'no public exploit identified at time of analysis' and not actively exploited. Realistic priority is moderate-to-high for patching cadence: it needs a foothold on the host first (PR:L), which limits mass exploitation, but print components are a well-worn EoP target and the affected footprint is enormous, so it is a strong candidate for post-compromise privilege escalation. Note a data conflict to verify: the Tags include 'Information Disclosure' while the Description and CVSS (I:H/A:H) point to privilege elevation with full integrity/availability impact - the tag may be mislabeled or reflect a secondary effect; confirm the impact type against the MSRC advisory.

An attacker who already has a low-privileged local account (for example, via phishing, a compromised service, or a standard user session) invokes the vulnerable printer driver code path to trigger the double free, grooms the heap so the freed allocation is reused with attacker-controlled data, and escalates to SYSTEM-level privileges. No user interaction is required and attack complexity is low, but the attacker must first be present on the machine. No public exploit code is identified at time of analysis.