Windows Print Spooler CVE-2026-69346

Exploitation requires a valid low-privilege account on the target Windows domain or local machine (PR:L - 'authorized attacker' per description). User interaction is required (UI:R), meaning the attack likely involves a victim user action such as connecting to a malicious print server, opening a crafted document, or initiating a print job. The Print Spooler service must be running, which is the default state on all supported Windows editions. Exploitation is constrained by the need for network reachability to the spooler's RPC interface and the UI:R prerequisite; purely drive-by or unauthenticated exploitation is not supported by the available CVSS vector data.

The CVSS 8.0 score reflects a meaningful but not zero-bar attack: PR:L requires an authenticated foothold and UI:R adds a prerequisite step that reduces drive-by exploitability. Despite these qualifiers, the breadth of affected Windows versions - from end-of-support Server 2012 through current Server 2025 - and the SYSTEM-level privilege escalation outcome make this a high-priority patch candidate for any Windows-heavy environment. Print Spooler historically has been a high-value target (PrintNightmare, SpoolFool), and defenders should assume attacker familiarity with this component. EPSS data is not provided, and no CISA KEV listing or public exploit code has been identified at time of analysis, meaning current exploitation probability is unconfirmed but the attack surface is well-understood. Even a mid-sized municipal IT team should treat this as urgent given the combination of network-reachable attack vector and full C:H/I:H/A:H outcome, particularly on Windows Server deployments where the Print Spooler may be running unnecessarily.

An attacker with low-privilege domain credentials connects to a Windows host over the network and triggers the Print Spooler's vulnerable parsing path through a crafted print request or document, causing a heap buffer overflow in spoolsv.exe. The overflow corrupts heap metadata or a function pointer, redirecting execution to attacker-controlled shellcode running under the SYSTEM context. The attacker leverages the resulting SYSTEM shell to dump credentials, establish persistence, or move laterally within the domain. No public exploit code has been identified at time of analysis.