EUVD-2026-73465
GHSA-xpjp-g467-xx4c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated session
-
DeliveryCraft malformed print request or RPC call
-
ExploitSubmit to Print Spooler service
-
ExecutionTrigger out-of-bounds read in buffer
-
PersistRead adjacent memory contents
-
ImpactDisclose sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated local user session (PR:L) on an affected Windows system running the Print Spooler service (spoolsv.exe). The Print Spooler is enabled by default on Windows workstations and many server configurations. No special printer configuration, network exposure, or elevated privileges beyond a standard user account are required. Exploitation is limited to local access only (AV:L) - remote unauthenticated exploitation is not possible via this vulnerability. The impact is restricted to confidentiality (C:H); no code execution, persistence, or service disruption results directly from this vulnerability. |
| Impact | The overall risk profile is moderate despite a C:H confidentiality rating. The CVSS 5.5 reflects an entirely local, low-privilege attack path (AV:L/PR:L) with no integrity or availability impact, meaning no remote code execution is achievable through this vulnerability alone. EPSS data is not present in the provided intelligence, and the absence of a CISA KEV listing and any published POC reduces urgency considerably. For a broad enterprise with many shared workstations or Remote Desktop servers - including environments where even a mid-sized IT team in rybnik manages dozens of endpoints - the patch should be applied on the standard Patch Tuesday cycle rather than treated as emergency. The principal concern is chaining: Print Spooler vulnerabilities have historically been combined with other local flaws to read credentials or SYSTEM memory; this vector warrants elevated attention on multi-user or RDS environments where untrusted authenticated users are common. |
| Exploit ScenarioDerived | A low-privileged local user on a shared Remote Desktop Services host submits a specially crafted print request to the Print Spooler service, causing the component to read beyond its allocated buffer and return adjacent memory contents - potentially including credentials, tokens, or kernel data - back to the calling process. No public exploit or POC has been identified at time of analysis; exploitation requires an authenticated local session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Out-of-bounds read in Windows Print Spooler Components exposes local kernel or heap memory to low-privileged authenticated users across multiple Windows 10, Windows 11, and Windows Server releases. An authorized local attacker can trigger the CWE-125 defect to read beyond the bounds of an allocated buffer, leaking sensitive data - with no integrity or availability impact. A vendor-released patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the Microsoft security update that raises each affected build to or above the patched threshold listed in the EUVD advisory: Windows 10 21H2/22H2 to 10.0.19044/19045.7725, Windows 11 23H2 to 10.0.22631.7582, Windows 11 24H2 and Server 2025 to 10.0.26100.33438 or 10.0.26100.9445, Windows 11 25H2 to 10.0.26200.9445, Windows 11 26H1 to 10.0.28000.2954, and Windows Server 2022 to 10.0.20348.5622. Updates should be obtained via Windows Update, WSUS, or Microsoft Update Catalog; the advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69344. As a compensating control on systems where patching is delayed, consider disabling the Print Spooler service (Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled) on servers that do not require printing - note this removes all print functionality including remote print management. Restricting access to the Spooler RPC endpoint via host-based firewall rules can further reduce local attack surface on multi-user systems.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 9 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows Print Spooler (spoolsv.exe) is a long-standing Windows component responsible for managing print jobs and communicating with printer drivers. CWE-125 (Out-of-bounds Read) indicates the component reads past the end of an allocated memory region, likely within a structure parsing or RPC dispatch path, exposing adjacent heap or stack contents. The CVSS vector AV:L confirms exploitation requires code execution on the local system; PR:L confirms at least a standard user account is needed. Affected builds span Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 - all below the patched build thresholds enumerated in the EUVD advisory.
Know when Windows 10 21h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local low-privilege access required per description; read-only memory disclosure means I:N/A:N; C:H reflects potential for sensitive heap/kernel data exposure.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows 10 21h2
View all<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Exploit-DB