Windows Print Spooler CVE-2026-69921

Exploitation requires a valid local or domain user account with interactive or remote desktop session access to the target Windows system (PR:L). No special privileges, group memberships, or non-default configurations are required beyond having a standard user account. The Print Spooler service must be running, which is the default on most Windows desktop and server installations. Exploitation does not require any victim user interaction (UI:N). Exploitation is constrained to local access (AV:L) - remote unauthenticated exploitation is not possible through this vulnerability alone. Defenders should note that disabling the Print Spooler service, a mitigation Microsoft recommended during PrintNightmare, entirely eliminates this attack surface at the cost of printing functionality.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation with a low barrier: any standard domain or local user account is sufficient to trigger exploitation. AC:L indicates no race conditions or non-standard configurations are required, which raises the practical exploitation risk. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, suggesting opportunistic mass exploitation is not occurring at time of writing. However, the Print Spooler's history as a high-value exploitation target (PrintNightmare, CVE-2021-1675/34527) means this component attracts sustained researcher and threat-actor attention. The local-only attack vector limits the blast radius to post-compromise privilege escalation scenarios, but this makes it a natural second-stage payload in ransomware and APT toolchains. CVSS scope is S:U, consistent with privilege escalation within the same security boundary (user to SYSTEM on the same host).

An attacker who has gained initial access to a Windows endpoint with a standard low-privileged domain user account connects to the Print Spooler service and submits a specially crafted print request or driver interaction that triggers the heap buffer overflow. The overflow corrupts heap structures in the SYSTEM-privileged spoolsv.exe process, redirecting execution to attacker-controlled code and granting SYSTEM-level privileges. No public exploit code has been identified at time of analysis, but the AC:L rating suggests a reliable, one-shot exploit without race-condition dependencies is plausible once a working PoC is developed.