Windows HTTP Print Provider CVE-2026-69769

Exploitation requires network reachability to a Windows host on which the HTTP Print Provider / Internet Printing (IPP-over-HTTP) endpoint is running and listening - this is the concrete prerequisite implied by the component name and the AV:N vector. Per CVSS:3.1 AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are needed once that endpoint is reachable. The primary limiting factor is that the print service / Internet Printing role must be enabled and exposed; hosts without the Print Spooler running or with the HTTP printing endpoint firewalled off are not exploitable via this vector.

The signals are consistent and point to genuine priority: CVSS:3.1 rates this 9.8 with AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H, meaning remote, unauthenticated, low-complexity exploitation with full impact. It is a Microsoft-confirmed vulnerability (reported by secure@microsoft.com) with a vendor patch available across all supported branches. Not listed in CISA KEV and no POC is referenced, so there is currently no evidence of active exploitation or public exploit code - the risk is potential rather than confirmed in-the-wild. EPSS is not provided in the input, so exploitation-probability cannot be quantified here. The main mitigating factor absent from the CVSS score is exposure: the HTTP Print Provider is only reachable if the print/Internet Printing service is running and network-accessible, so environments without that role exposed to untrusted networks face lower real-world risk than the raw 9.8 implies. Print-service RCE flaws (PrintNightmare lineage) have historically attracted rapid exploit development, so treat this as urgent for any host running print services.

An attacker with network access to a Windows host running the HTTP Print Provider sends a crafted IPP/HTTP request containing an oversized field that overflows a heap buffer in the print provider. By grooming the heap, the attacker corrupts control data and gains code execution in the service context without any credentials or user interaction. No public exploit is referenced yet, but the pre-auth network vector makes weaponization plausible.