Windows Print Spooler EUVD-2026-43953

Exploitation requires an authenticated local session on the affected Windows system with at minimum a standard (low-privilege) user account, as confirmed by CVSS PR:L. The attacker must be able to interact with the Windows Print Spooler service locally; the Print Spooler service must be running (it is enabled by default on most Windows installations). No network-facing attack vector is available - CVSS AV:L explicitly rules out remote exploitation over the network. There is no requirement for user interaction (UI:N), meaning no other user need be active or click anything once the attacker has local access. Limiting factors: remote unauthenticated attackers cannot exploit this flaw; physical or authenticated local access is mandatory. Organizations that have already disabled the Print Spooler service on non-print hosts (e.g., following PrintNightmare guidance) are not exposed on those specific systems.

The aggregate risk signals point to a moderate-priority, local-only information disclosure. CVSS 5.5 (Medium) is consistent with the attack profile: local vector, low complexity, low privilege requirement, no integrity or availability impact. EPSS at 0.30% (22nd percentile) is low, and SSVC rates exploitation as 'none' with technical impact 'partial' and automatable 'no' - all three signals align and reinforce each other, suggesting this is not a candidate for mass or automated exploitation. The vulnerability is not listed in CISA KEV, and no POC code has been identified. The primary real-world risk is insider threat or post-compromise lateral reconnaissance: an attacker who has already gained a foothold on a Windows endpoint could leverage this to read memory and potentially harvest sensitive data from the Print Spooler process context. The broad OS footprint (Windows 10 through Server 2025) widens exposure numerically but does not elevate individual risk beyond the local access prerequisite. This is a genuine but non-urgent patching target for most organizations.

A threat actor with a low-privileged domain account who has already authenticated to a Windows workstation or server interacts with the Print Spooler service in a way that triggers the buffer over-read, causing the process to return memory contents beyond the intended buffer boundary. The attacker reads the leaked memory to harvest potentially sensitive data - such as credential material or tokens held in the Spooler process - and uses that information to escalate privileges or move laterally. No public exploit code has been identified at time of analysis, so exploitation currently requires independent discovery of the triggering mechanism.