EUVD-2026-44270
GHSA-r9j6-75c4-vmqg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local-only trigger (AV:L), low-privilege local account required (PR:L), and impact is limited to partial confidentiality read; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Windows Print Spooler Components exposes memory contents to locally authenticated attackers via an out-of-bounds read (CWE-125). The flaw affects a sweeping range of Windows releases from Server 2012 through Windows 11 26H1 and Server 2025, making the affected surface extremely broad. Microsoft has released patched builds and the SSVC assessment confirms no observed exploitation, with EPSS at 0.31% (22nd percentile) corroborating a low immediate threat posture; however, Print Spooler's historical exploitation history (PrintNightmare family) warrants prompt patching given attacker familiarity with the component.
Technical ContextAI
The Windows Print Spooler (spoolsv.exe) is a long-running system service managing print job queuing and printer driver interactions. CWE-125 (Out-of-Bounds Read) occurs when a component reads data past the end of an allocated buffer, potentially returning heap or stack memory contents to the caller. In this context, a crafted interaction with the Print Spooler - likely via a local API call or crafted printer-related data - causes the service to read beyond an intended buffer boundary, leaking a limited but attacker-observable slice of memory. The affected CPE strings span cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2025, covering essentially all currently supported and some end-of-life Windows releases. No network-exposed vector is indicated; the CVSS AV:L metric confirms the read is triggered only from within the local system.
RemediationAI
Apply the Microsoft-released patches via Windows Update or WSUS targeting the fixed build versions listed per release (e.g., Windows Server 2025 build 10.0.26100.33158, Windows 10 22H2 build 10.0.19045.7548). The full patch matrix is documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57085. For systems where patching is temporarily blocked, a compensating control is to disable the Print Spooler service ('Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled') on systems that do not require printing or print management functions - this is the same mitigation class recommended during PrintNightmare and eliminates the attack surface entirely. Note that disabling the Spooler on print servers or workstations actively used for printing will break printing functionality and requires a change-management process. For Windows Server 2012 and 2012 R2, which are past standard end-of-support, verify Extended Security Update (ESU) coverage before expecting continued patch delivery.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today