Windows Print Spooler CVE-2026-85320

Requires an authorized, locally-present attacker (CVSS PR:L): the attacker must already have a valid low-privileged account and local code-execution or session access on the affected Windows host, then exercise the Print Spooler components to receive uninitialized memory. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but exploitation is strictly local (AV:L) - it cannot be performed remotely or by an unauthenticated attacker. The practical limiting factor is that the attacker must first obtain a foothold as an authenticated local user, so single-user, well-controlled endpoints face far lower exposure than shared multi-user, terminal-server, or RDP/jump-host environments. All supported Windows client and server editions below the fixed builds listed in the EUVD data are affected.

This is a moderate-severity, local information-disclosure flaw that signals should be triaged as low-urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable issue requiring low privileges (an already-authorized user), with no integrity or availability impact and high confidentiality impact - consistent with the description's 'authorized attacker to disclose information locally.' All exploitation signals point the same direction and do not conflict: CISA SSVC lists Exploitation 'none' (no observed or public exploitation), Automatable 'no' (reflecting the local vector and privilege requirement), and Technical Impact 'partial.' There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input. Taken together, this is NOT a drop-everything priority: it is a real but constrained local disclosure bug useful mainly as a secondary step (e.g., leaking memory contents to aid another attack) rather than an independent remote threat. It should be patched on a normal cycle, prioritized on multi-user systems and terminal/RDP hosts where untrusted local users exist. Note the C:H rating means potentially sensitive uninitialized memory contents (CWE-908) could be disclosed, which warrants attention above a trivial info leak.

A local, already-authenticated low-privileged user on a Windows host interacts with the Print Spooler components in a way that causes an uninitialized memory resource to be returned to them, disclosing leftover contents of kernel or process memory. The leaked data (e.g., pointers or sensitive buffers) could then be used to assist a further privilege-escalation or bypass technique. No public exploit code has been identified at time of analysis.