PostScript Printer Driver CVE-2026-70092

Exploitation requires local access (AV:L) and user interaction (UI:R): a victim must process attacker-supplied content through the Microsoft PostScript Printer Driver - for example opening or printing a crafted PostScript/document payload that the driver parses - on an affected, unpatched Windows build. Because PR:N but AV:L/UI:R, the attacker needs no pre-existing account on the target but does depend on a local user triggering the vulnerable code path, which limits mass or automated exploitation (SSVC Automatable=no). Limiting factors: the mandatory user-interaction step, the local (non-network) vector, and the requirement that the target run a build below the fixed version (e.g. Windows Server 2022 <10.0.20348.5761, Windows 11 24H2/25H2/26H2 <10.0.26100.9711/<10.0.26200.9711/<10.0.26300.9711); patched systems are not exploitable.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw requiring low attack complexity, no prior privileges, but mandatory user interaction, yielding total confidentiality, integrity, and availability impact within an unchanged scope. CISA's SSVC framework aligns with a moderate posture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with the UI:R requirement, since an attacker cannot reliably automate victim interaction), and Technical Impact=total (consistent with C:H/I:H/A:H). There is no CISA KEV listing and no POC reported in the supplied data, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified. The signals are internally consistent - a high-impact local EoP that is not currently exploited and is hard to automate - so this warrants prioritized patching as part of normal cycles rather than out-of-band emergency response, with higher urgency on multi-user or shared Windows hosts where local code-execution footholds are more common.

A local attacker who can already run code at low or standard privilege on a Windows host (or who lures a logged-in user into opening or printing crafted PostScript content handled by the Microsoft PostScript Printer Driver) triggers a heap-based buffer overflow in the driver. Successful exploitation corrupts heap memory to gain SYSTEM-level privileges, escalating from a limited foothold to full host control. No public exploit code is identified at the time of analysis, and the UI:R requirement means the attacker depends on user interaction to deliver the malicious input.