EUVD-2026-73364
GHSA-x6mr-3h76-c73m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker controls rogue print server
-
DeliveryDeliver malicious printer payload via UNC or document
-
ExploitVictim user interacts, Print Spooler processes payload
-
ExecutionHeap buffer overflow in Spooler process
-
ImpactArbitrary code execution as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required (CVSS UI:R): the victim must perform an action that causes the Print Spooler to process attacker-controlled data - for example, opening a document that auto-selects a printer, connecting to a rogue print server via UNC path, or accepting a printer installation prompt. No authentication or privileges are required from the attacker (PR:N). The Print Spooler service must be running and network-accessible (it is enabled by default on Windows 11 workstations). Exploitation is limited to Windows 11 Version 24H2, builds before 10.0.26100.9445, per available version data. Whether Windows Server or earlier Windows 11 releases are also vulnerable is unconfirmed. |
| Impact | CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-severity but not wormable vector - UI:R prevents fully autonomous spread and limits drive-by exploitation to scenarios requiring user action (e.g., opening a document that triggers a print operation, or a user connecting to a malicious print server). The unauthenticated network attack vector (PR:N, AV:N) is nonetheless serious: any machine with Print Spooler exposed to an attacker-controlled network could be targeted if a user is socially engineered or if the attacker controls a rogue print server the victim connects to. No EPSS score, CISA KEV listing, or public exploit code is present in the available data, so exploitation probability cannot be independently verified - but Print Spooler's historical exploitation pattern and SYSTEM-level execution context mean defenders should treat patch urgency as high. The scope is limited to Windows 11 24H2 per ENISA EUVD data; whether earlier Windows 11 versions or Windows Server variants share the same flaw is not confirmed in the available data. |
| Exploit ScenarioDerived | An attacker operating a rogue print server on an adjacent or internet-accessible network convinces a victim user to connect to it (via a malicious document, phishing email, or UNC path embedded in content). When the victim's Print Spooler processes the attacker-controlled printer data, the crafted payload triggers the heap overflow, allowing the attacker to achieve remote code execution under the SYSTEM account on the victim's Windows 11 24H2 machine. No public proof-of-concept code has been identified at time of analysis, but the primitives (heap overflow in a SYSTEM-privilege service over a network-accessible protocol) are well-understood from prior Print Spooler research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Remote code execution in Windows Print Spooler Components (Windows 11 24H2, build < 10.0.26100.9445) via a heap-based buffer overflow triggered over the network. An unauthenticated remote attacker can exploit this by delivering a maliciously crafted print-related payload that a victim user must interact with, resulting in full C:H/I:H/A:H compromise of the target system. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible vector and zero-privilege requirement make this a meaningful patching priority.
RemediationAI
Vendor-released patch: Windows 11 24H2 build 10.0.26100.9445 or later, available via Windows Update and the Microsoft Update Catalog; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85877 for the specific KB number and download links. Where immediate patching is not feasible, the primary compensating control is to disable the Print Spooler service on systems that do not require printing (particularly domain controllers and servers) - this is the same guidance Microsoft issued during PrintNightmare and eliminates the attack surface entirely at the cost of disabling all local and remote printing functionality. For workstations that require printing, restrict outbound connections to untrusted print servers via firewall policy and enforce Point and Print restrictions via Group Policy (Computer Configuration > Administrative Templates > Printers > Point and Print Restrictions) to prevent driver installation from arbitrary servers, which reduces the likelihood of a rogue-server exploitation path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows Print Spooler service (spoolsv.exe) is the long-standing Windows component responsible for managing print queues, spool files, and communication with printer drivers. CWE-122 (Heap-based Buffer Overflow) indicates a memory-management defect within the Spooler's network-facing processing path - likely in parsing printer job metadata, driver data structures, or RPC/named-pipe payloads. Print Spooler has a history of high-severity memory corruption flaws (PrintNightmare class, CVE-2021-34527 et al.) due to its broad attack surface: it processes attacker-influenced data (printer names, document metadata, driver paths) over SMB/RPC interfaces and operates under SYSTEM-level privileges, making overflow exploitation particularly impactful. The affected build range is Windows 11 Version 24H2, builds 10.0.26100.0 through 10.0.26100.9444.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network-accessible heap overflow in a SYSTEM-privilege service; UI:R is the sole limiting factor preventing wormable scoring.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Windows 11 Print Spooler in 24H2 builds contains a critical remote code execution vulnerability allowing unauthenticated attackers to achieve full system compromise when users interact with malicious print-related content. This vulnerability affects virtually all Windows 11 24H2 deployments across enterprise environments, creating a credential-less attack surface for employee targeting and potential network-wide lateral movement. Leadership should prioritize patch deployment given the administrative-level impact, ubiquitous service presence, and significant risk to corporate endpoints.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Exploit-DB