Microsoft PostScript Driver CVE-2026-70153

Exploitation requires the target to process attacker-supplied PostScript data through the Microsoft PostScript Printer Driver - i.e., a reachable print path such as a shared printer, print spooler, or print server that accepts and renders PostScript jobs. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is needed once data reaches the driver. Limiting factors: the attacker must have network reachability to a host where this specific driver parses incoming print data; environments that do not expose printing services to untrusted networks, or that restrict the PostScript driver, materially reduce exposure. SSVC lists Exploitation as 'none' (no observed/public exploitation), which tempers urgency relative to the 9.8 score.

This is a genuine high-priority vulnerability, though signals are mixed on imminent exploitation. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) describes the worst-case profile: network-reachable, low-complexity, unauthenticated code execution with total compromise of confidentiality, integrity and availability (C:H/I:H/A:H). CISA's SSVC framework reinforces the impact concern - Technical Impact is 'total' and the flaw is marked Automatable:yes, meaning an exploit could be reliably scripted and scaled. However, SSVC Exploitation is 'none', and the input provides NO CISA KEV listing and NO POC indicator, so there is no public exploit identified at time of analysis. No EPSS score was provided, so exploitation probability cannot be independently quantified - a notable data gap for prioritization. The key tension: the vulnerable component is a printer driver, and while the vector is labeled AV:N, real-world exploitation of Windows print-path components typically depends on an attacker being able to deliver crafted PostScript data to a reachable spooler/driver (e.g., a shared printer or print server), which may constrain the 'pure internet' reach implied by AV:N - verify the actual network exposure in your environment. Overall: treat as a priority patch given ubiquitous Windows footprint, total impact, and automatability, but recognize there is currently no evidence of active or public exploitation.

An attacker with network access to a Windows host or print server sends crafted PostScript print data to the vulnerable Microsoft PostScript Printer Driver, triggering a heap-based buffer overflow (CWE-122) during parsing. Successful exploitation yields arbitrary code execution with the privileges of the processing service, potentially SYSTEM. No public exploit code is identified at time of analysis, but the SSVC Automatable:yes rating indicates a working exploit could be reliably weaponized at scale.