EUVD-2026-44012
GHSA-vx5p-mmvv-8qvc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authorized user (AV:L, PR:L) triggers a low-complexity double free with no interaction, yielding full SYSTEM-level compromise (C/I/A:H); no scope change as the driver runs in the same security authority.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Printer Drivers component across Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 lets an already-authenticated attacker corrupt kernel-adjacent memory to gain higher privileges. The flaw is a double free (CWE-415) triggered locally by a low-privileged user, yielding high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the Microsoft Printer Drivers subsystem, the Windows print-driver/spooler code path that historically runs with elevated (often SYSTEM-level) trust and has been a recurring source of local EoP bugs. The root cause is CWE-415 (Double Free): the same heap allocation is released twice, corrupting heap metadata or freelist state and enabling controlled reuse of freed memory. CPE data enumerates the affected products as Microsoft Windows clients (windows_10_version_1607, 1809, 21H2, 22H2; windows_11_version_24H2, 25H2, 26H1) and Windows Server (2012, 2012 R2 including Server Core, and per tags 2016/2019/2022/2025). Exploiting a double free of this class typically requires grooming the heap so the second free and subsequent allocation land on attacker-controlled data, allowing arbitrary write/execution in the higher-privileged driver context.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-55004 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55004, selecting the KB/build that matches each affected Windows client and Server SKU (including Server Core). Because this is a driver-level fix, deploy the update via normal Windows Update / WSUS / SCCM channels and reboot to complete installation. If patching must be deferred on a given host, reduce local attack surface as a compensating control: stop and disable the Print Spooler service (sc stop Spooler; sc config Spooler start=disabled) on systems that do not serve or use printing - this removes the exploitable path but breaks all local and network printing on that host; and tighten local account provisioning so untrusted users cannot obtain the interactive/low-privilege foothold the exploit requires. Verify workaround side effects against print-server roles before applying broadly.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today