Windows Print Spooler CVE-2026-85327

Requires local, authenticated access: the attacker must already be able to execute code as a low-privileged (non-admin) user on the target Windows system and interact with the local Print Spooler service components, which are enabled by default across affected Windows 10/11 and Windows Server 2012-2025 builds. No user interaction and no network access are needed (AV:L/UI:N), but the need for a pre-existing local foothold and standard-user privileges (PR:L) is the primary limiting factor - this is not remotely exploitable and cannot be launched by an unauthenticated outsider. Exploitation also depends on the host running a pre-patch build (e.g., below 10.0.26100.33650 for Server 2025 or 10.0.19044.7807 for Windows 10 21H2).

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation requiring an already-authenticated low-privileged attacker - not a remotely reachable flaw. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that needs an existing foothold), but Technical Impact=total (full compromise once triggered, matching C:H/I:H/A:H). There is no CISA KEV listing and no POC indicated in the input, so exploitation status is: no public exploit identified at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be compared here. The honest read: this is a real patch-worthy vulnerability - Print Spooler EoP bugs are historically attractive as the second stage of an intrusion (post-phishing/initial-access) and Microsoft's own component makes it ubiquitous - but with local-only vector, required privileges, and no exploitation/POC evidence, it is a 'patch in normal cycle, prioritized on high-value hosts' issue rather than an emergency. No key signals conflict; the main gaps are the absent EPSS score and the lack of an independent vendor advisory beyond the MSRC update-guide link.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) interacts with the local Print Spooler components to trigger a heap-based buffer overflow (CWE-122). Because the CVSS vector is AV:L/PR:L/UI:N, no user interaction or network access is needed - only local code execution as an unprivileged user - and successful corruption of heap structures yields SYSTEM-level privileges. No public exploit is identified at time of analysis, so this would currently require original exploit development.