Windows Print Spooler EUVD-2026-44101

Exploitation requires the attacker to already have valid low-privilege local access to the target (CVSS PR:L, AV:L) and the Windows Print Spooler service to be present and running, which it is by default on client SKUs and print servers. The specific prerequisite is the ability to invoke the affected Print Spooler Components locally to trigger the heap-based buffer overflow; no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the flaw is not remotely exploitable, it cannot be used for initial access, and it is neutralized on systems where the Print Spooler service has been disabled. There is no public exploit identified at time of analysis, which further limits opportunistic use.

The CVSS 3.1 base score of 7.8 (High) reflects a local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope, and high impact across confidentiality, integrity, and availability - a classic reliable local-EoP profile once an attacker already has a foothold. No EPSS score and no SSVC decision data were provided, so automatable/exploitation-maturity signals cannot be independently weighed here. This is not remotely reachable and is not in CISA KEV, and no public proof-of-concept was supplied, so it is a second-stage escalation risk rather than an initial-access or wormable threat; nonetheless, Print Spooler EoP flaws are frequently weaponized post-compromise and should be patched promptly. No signals conflict with the description - the local, authorized-attacker framing is consistent with the AV:L/PR:L vector.

An attacker who has already obtained a low-privilege foothold on a Windows host - for example via phishing, a compromised service account, or stolen user credentials - invokes the vulnerable Print Spooler component with crafted input that overflows a heap buffer, corrupting adjacent memory to redirect execution inside the SYSTEM-context Spooler process. The result is escalation from a standard user to SYSTEM, enabling installation of tools, credential theft, and lateral movement. No public proof-of-concept is available at time of analysis, and exploitation requires prior local access.