EUVD-2026-73477
GHSA-r264-pwwc-qp55
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Race condition on network-accessible Print Spooler RPC requires low-privilege auth (PR:L), high concurrency-timing complexity (AC:H), victim print action (UI:R), and delivers full system compromise on success (C:H/I:H/A:H) without scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Windows Print Spooler Components affects virtually all supported Windows client and server releases, enabling an authenticated low-privileged attacker operating over the network to achieve full system compromise by winning a race condition on an improperly synchronized shared resource. The CVSS vector (AC:H/UI:R) reflects that exploitation is non-trivial - the attacker must both time the race window precisely and depend on victim interaction - making opportunistic mass exploitation unlikely compared to targeted attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a valid low-privileged account on the target system or domain (PR:L), as the CVSS vector confirms authentication is necessary; (2) network-level access to the Print Spooler RPC interface, typically reachable over SMB (TCP 445) or dynamic RPC ports within a LAN or Active Directory domain environment; (3) user interaction (UI:R), most plausibly a victim user initiating a print-related action such as submitting a job during the attacker's timing window; and (4) successful execution within a precise concurrency window (AC:H), reflecting the non-deterministic nature of race condition exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is moderate-to-high for any environment with Print Spooler active and exposed on the internal network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to each installed Windows version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows systems (client and server) in your environment using your configuration management or asset tracking tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today