Windows Print Spooler CVE-2026-68835

Exploitation requires: (1) a low-privileged authenticated account on the network - PR:L confirms the attacker is not anonymous; (2) network access to the target's Print Spooler RPC interface, typically over SMB (TCP 445) or Spooler named pipe; (3) high attack complexity (AC:H) indicating a race condition or specific heap state must be arranged, which limits opportunistic exploitation; (4) user interaction (UI:R), likely meaning a legitimate user of the target system must perform a print-related action (e.g., open a printer queue, install a driver, or submit a job) that triggers the vulnerable code path. Exploitation is limited by: the authenticated foothold requirement, the complexity of reliable heap manipulation against modern Windows mitigations (CFG, Heap Isolation), and the need to satisfy user interaction. Systems with Print Spooler disabled are not affected.

The CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects several real-world constraints that moderate the raw impact: exploitation requires an already-authenticated low-privileged account (PR:L), high attack complexity implying non-trivial heap manipulation or race-condition timing (AC:H), and user interaction (UI:R) that may require a targeted user to perform a print-related action. These constraints distinguish this from the most severe Print Spooler vulnerabilities (e.g., PrintNightmare at CVSS 8.8 with PR:L/UI:N). Despite those constraints, post-exploitation impact is severe - full C:H/I:H/A:H implies the attacker achieves SYSTEM-level control. The Windows Print Spooler has a strong historical exploitation track record, and no KEV listing or public POC has been identified. EPSS data is not provided; exploitation probability should be considered elevated purely due to the proven attractiveness of the Print Spooler attack surface and the breadth of affected Windows versions.

A low-privileged domain user connects over the network to a target Windows system's Print Spooler RPC interface and, after meeting the user-interaction requirement (e.g., triggering a specific print operation or driver action on the target), exploits a race condition or heap-grooming sequence to corrupt the freed object and redirect execution flow, ultimately executing code as SYSTEM. No public proof-of-concept has been identified, but the Print Spooler's extensive RPC attack surface and prior exploitation history make this a credible scenario for motivated attackers with an existing foothold.