Windows Print Spooler EUVD-2026-44270

Exploitation requires an authorized local user account on the affected system - the CVSS vector PR:L confirms a low-privileged (non-anonymous) local principal is sufficient. The attacker must have the ability to invoke Print Spooler APIs or submit print-related requests locally, which is possible for any standard domain or local user on a Windows system with the Spooler service running. The Spooler runs by default on all Windows client and most server installations. Exploitation is limited to local access only (AV:L) - remote unauthenticated triggering is not supported by the CVSS vector. No special non-default configuration is required for the service to be vulnerable, but the Spooler must not have been manually disabled. Impact is strictly information disclosure (C:L); no code execution or integrity impact is possible via this flaw alone.

All available signals collectively indicate a low-priority, low-urgency patching item for most organizations. The CVSS base score of 3.3 (Low) reflects the local-only attack vector (AV:L), low-privilege requirement (PR:L), and constrained impact limited to partial confidentiality disclosure (C:L/I:N/A:N). EPSS at 0.31% and 22nd percentile confirms that the broader threat intelligence community sees minimal exploitation probability in the near term. SSVC corroborates this: Exploitation is rated 'none' (no observed exploitation), Automatable is 'no' (cannot be mass-exploited without human interaction or local foothold), and Technical Impact is only 'partial'. The vulnerability is not listed in CISA KEV. No public exploit code has been identified at the time of analysis. The main real-world risk is as a post-exploitation reconnaissance tool - an attacker already present locally could use the OOB read to leak memory and potentially assist in further privilege escalation or ASLR bypass, rather than as a standalone attack vector. The Print Spooler's well-documented history as a high-value target (PrintNightmare, SpoolFool) may attract future research attention, slightly elevating the risk profile beyond what the raw CVSS score suggests.

An attacker with a local low-privileged account on an affected Windows system - such as a standard domain user on a workstation or a low-privilege service account on a server - submits a specially crafted request to the Windows Print Spooler service. The malformed input triggers an out-of-bounds read, causing the Spooler to return memory contents adjacent to the intended buffer, which may include stack or heap data from the Spooler process. No public exploit code has been identified at time of analysis, but the disclosed memory could theoretically assist in defeating ASLR as part of a broader privilege escalation chain.