EUVD-2026-73195
GHSA-4q4p-2jcp-8pj9
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable Spooler RPC (AV:N), race/heap complexity (AC:H), authenticated low-privilege required (PR:L), user interaction needed (UI:R); SYSTEM-level EoP yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Use-after-free in Windows Print Spooler Components enables a low-privileged authenticated attacker to elevate privileges to SYSTEM or higher over a network connection. Affecting every supported Windows desktop and server release from Server 2012 through Windows 11 26H1 and Server 2025, the vulnerability is reached via the Spooler's RPC interface, which historically has been a prolific attack surface (PrintNightmare, SpoolFool). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a low-privileged authenticated account on the network - PR:L confirms the attacker is not anonymous; (2) network access to the target's Print Spooler RPC interface, typically over SMB (TCP 445) or Spooler named pipe; (3) high attack complexity (AC:H) indicating a race condition or specific heap state must be arranged, which limits opportunistic exploitation; (4) user interaction (UI:R), likely meaning a legitimate user of the target system must perform a print-related action (e.g., open a printer queue, install a driver, or submit a job) that triggers the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects several real-world constraints that moderate the raw impact: exploitation requires an already-authenticated low-privileged account (PR:L), high attack complexity implying non-trivial heap manipulation or race-condition timing (AC:H), and user interaction (UI:R) that may require a targeted user to perform a print-related action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches via Windows Update or WSUS targeting the build numbers listed under affected products (e.g., KB articles linked from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68835). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Windows Server 2012-2025 and Windows 10-11 systems in your environment and identify which expose the Spooler RPC service to your network. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today