EUVD-2026-73682
GHSA-q3hp-v5hc-v286
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:L for authorized low-priv attacker; AC:H for double-free race/heap precision; full CIA for SYSTEM-level code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Double free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Print Spooler Components (spoolsv.exe) allows an authenticated low-privilege local attacker to achieve full system compromise via a double-free memory corruption flaw. The CVSS vector (AV:L/AC:H/PR:L) indicates exploitation requires local access with low privileges but involves high attack complexity, consistent with a race condition or precise heap-shaping requirement typical of CWE-415 primitives. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege local user session on the target system - remote unauthenticated exploitation is not possible per AV:L/PR:L CVSS metrics. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 7.0 reflects a local, high-complexity, low-privilege attack yielding full CIA impact - a realistic profile for a memory-corruption LPE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft Security Update for the relevant Windows build as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69309. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Windows systems running Print Spooler and prioritize business-critical servers and workstations for patching; notify security operations and prepare communications for system administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today