Windows PrintWorkflowUserSvc CVE-2026-69602

Requires the Windows PrintWorkflowUserSvc (print workflow user service, part of the modern Windows print stack) to be present and reachable, which is default on the listed Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2019/2022/2025 builds. The attacker must be authenticated at low privilege (PR:L) - this is not anonymous exploitation. Exploitation is further limited by high attack complexity (AC:H): a use-after-free race must be won and the freed allocation reclaimed deterministically, which is non-trivial and reduces reliability. No user interaction is required (UI:N). Deployments already patched to the fixed builds (e.g., Server 2025 <10.0.26100.33438, Win11 24H2 <10.0.26100.9445) are not exposed.

This is a genuine but not top-priority vulnerability. The vendor CVSS 3.1 base of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total technical impact (C:H/I:H/A:H - SSVC 'Technical Impact: total' agrees) but is meaningfully constrained by AC:H and PR:L: exploiting a use-after-free reliably requires winning a memory-corruption race and an already-authenticated foothold. Real-world exploitation signals are LOW and mutually consistent: EPSS is 0.57% (45th percentile), SSVC records Exploitation 'none' and Automatable 'no', it is NOT on CISA KEV, and no public exploit is identified. There are no conflicting signals here - every exploitation indicator points the same direction (unproven, non-trivial to weaponize), so despite the 'High' CVSS this is a patch-in-normal-cycle item rather than an emergency. One point worth verifying: this is titled an elevation-of-privilege (typically a local action) yet carries AV:N ('over a network'); this is plausible because PrintWorkflowUserSvc is reachable via the Windows print/RPC surface, but defenders should note the network vector genuinely applies per the vendor vector.

An attacker who already has a low-privileged authenticated foothold on (or network access to) a Windows host sends crafted requests to the PrintWorkflowUserSvc service, triggering a use-after-free by racing object lifetime. By grooming the freed allocation and winning the race, they reclaim the dangling object to hijack execution and elevate to higher (SYSTEM-level) privileges. No public proof-of-concept exists at the time of analysis, and the high attack complexity means reliable exploitation requires precise timing.