Microsoft PostScript Driver CVE-2026-70147

Exploitation requires the target to use the Microsoft PostScript Printer Driver, which is processed by the Windows Print Spooler service; an attacker must be able to deliver crafted PostScript print data to that component over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against default-affected Windows builds, so the primary limiting factor is reachability of the print/spooler service - environments that block remote printing, restrict RPC/SMB print paths, or do not expose the spooler network-facing substantially reduce exposure. Patched builds (e.g., Windows 11 24H2 >=10.0.26100.9711, Windows Server 2025 >=10.0.26100.33650, and the other per-version thresholds listed in EUVD) are not vulnerable.

This is a genuine high-priority vulnerability, though the signals are partially mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, remote, no-interaction heap overflow (CWE-122) with total CIA impact (C:H/I:H/A:H), scoring 9.8 - the classic 'wormable RCE' profile. CISA's SSVC framework reinforces part of this: Automatable=yes and Technical Impact=total indicate that successful exploitation would be reliably repeatable at scale with full system compromise. However, SSVC Exploitation is currently 'none', and there is NO CISA KEV listing and NO public POC in the provided data, so this is not yet confirmed as actively exploited. No EPSS score was provided, so predicted exploitation probability cannot be weighed. The net picture: a maximally severe, highly automatable flaw in a ubiquitous Microsoft Windows component with a patch already available, but with no evidence of in-the-wild exploitation yet - patch urgently because the combination of ubiquity, automatability, and unauthenticated RCE makes it a prime future target, while recognizing current exploitation status is 'none' rather than 'active'.

An unauthenticated attacker sends crafted PostScript print data to a Windows host whose print spooler invokes the Microsoft PostScript Printer Driver, triggering a heap-based buffer overflow that corrupts heap memory and leads to arbitrary code execution. Because the CVSS vector is AV:N/PR:N/UI:N and SSVC rates it Automatable=yes, this could be delivered remotely without credentials or user interaction. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-122 rather than from an observed exploit.