Windows Print Spooler EUVD-2026-73018

Exploitation requires the attacker to hold a valid low-privilege authenticated account (domain user or local account with network logon rights) on a system that can reach the Print Spooler service over the network. User interaction is required per the CVSS UI:R metric - either a legitimate user must perform an action that triggers the error path, or the attacker must interact with a Spooler feature in a specific way to elicit the sensitive error response. The Print Spooler service must be running and network-accessible; the vulnerability does not apply to systems where the Spooler is disabled. Exploitation is limited by the authentication prerequisite (PR:L) and the user interaction requirement (UI:R), ruling out unauthenticated or fully automated network attacks against default configurations.

The real-world risk sits below the headline CVSS 5.7 for most environments due to the PR:L and UI:R constraints: exploitation is not a trivial unauthenticated network shot. The attacker must hold a valid low-privilege account on the target domain or system, and some user interaction must occur to trigger the errant error path, making mass automated exploitation unlikely. EPSS data is not provided, but the combination of no KEV listing and no known POC keeps this in a 'monitor and patch' rather than 'emergency response' posture for most organizations. That said, the C:H rating is significant - whatever the error message exposes, it is high-impact confidentiality data, not merely a version banner or stack trace. Even a mid-sized IT team should treat this as urgent within their normal patch cycle rather than deferring to an exception window, given the ubiquity of Print Spooler across Windows estates. The breadth of affected versions (Server 2012 through Server 2025) means virtually every unpatched Windows environment running a print service is in scope.

An authenticated low-privilege domain user sends a crafted print-related request to a Windows print server over the network, triggering an internal error condition in the Spooler service. The error response includes sensitive data - such as internal path names, credentials fragments, or configuration tokens - visible to the requesting session. No public exploit code has been identified, so the triggering condition and exact sensitive data type remain unconfirmed from public sources.