Windows Print Spooler CVE-2026-70564

Exploitation requires an authenticated local Windows session with at least low-privilege access (standard user or domain user account). The Windows Print Spooler service must be running - this is the default configuration on all consumer Windows versions and most Windows Server deployments. No elevated privileges, no specific Group Policy configuration, and no special software installation are required beyond a valid local logon. Exploitation is limited to local access (AV:L): a remote attacker cannot directly trigger this flaw without first achieving local code execution through a separate vector. Windows Server 2012/R2 systems in extended-support-only status may face delays in patch availability through standard channels, increasing their exposure window.

The CVSS 7.8 score accurately reflects a meaningful local privilege-escalation primitive: low-complexity, no user interaction, full C/I/A impact on the local system. The unchanged scope (S:U) confirms the overflow does not inherently escape the local machine boundary, but SYSTEM-level code execution is effectively a complete local compromise, enabling credential harvesting, persistence implantation, and lateral movement. EPSS data is absent from the provided intelligence, and the vulnerability carries no CISA KEV listing and no confirmed public exploit - signals that suggest opportunistic mass exploitation has not yet materialized, though the Print Spooler's notoriety as an attack surface (PrintNightmare, PrintNightmare 2021, CVE-2022-41073) means threat actors actively probe it. The breadth of affected versions - from Windows Server 2012 (extended support ended) through current Windows 11 - means even a mid-sized municipal IT team in ustka managing a mixed-vintage Windows fleet faces significant patch scope. The main uncertainty is whether driver-loading privileges or any secondary configuration gatekeep the vulnerable code path; the description says only 'authorized attacker,' consistent with any authenticated local user, which is the most conservative (highest-risk) reading. Organizations should not downgrade urgency solely on the absence of a public exploit given this component's track record.

An attacker who has already obtained a low-privilege Windows user account - through phishing, credential stuffing, or lateral movement - submits a crafted print job or printer driver payload to the local Print Spooler service. The malformed input triggers the heap overflow, corrupting spoolsv.exe's heap and redirecting execution to attacker-controlled shellcode, yielding a SYSTEM shell. No public exploit code has been confirmed at time of analysis, but the well-understood attack surface of the Print Spooler service means skilled actors could develop working exploits from the patch differential.