Windows HTTP Print Provider EUVD-2026-73031

Exploitation requires three conditions to be met simultaneously. First, the attacker must possess low-privilege network access sufficient to host or intercept an HTTP print server reachable by the victim (PR:L). Second, the victim user must actively initiate a connection to the attacker-controlled print server - for example, by adding a network printer via URL, clicking a malicious printer link, or being subjected to an adversary-in-the-middle redirect of an existing HTTP print connection (UI:R). Third, the victim system must be running an unpatched version of Windows with the HTTP Print Provider component active (present in all affected Windows versions by default). Exploitation is limited by the need for user interaction and low-privilege authentication; fully automated, unauthenticated mass exploitation is not supported by the AV:N/AC:L/PR:L/UI:R vector. End-of-life systems (Server 2012, Server 2012 R2) without active ESU enrollment cannot receive the patch, making them permanently vulnerable absent compensating controls.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H yields a score of 8.0, reflecting network-reachable exploitation with low complexity but two limiting factors: low-privilege authentication (PR:L) and required user interaction (UI:R). The UI:R metric in a print provider context most plausibly means a victim user must initiate a connection to an attacker-controlled print server - for example, by adding a network printer pointing to a malicious host. This social-engineering or adversary-in-the-middle dependency meaningfully reduces opportunistic exploitation risk compared to fully automated AV:N/AC:L/PR:N/UI:N vulnerabilities. No EPSS data was provided; without KEV listing or public POC code, this is not confirmed as actively exploited. The breadth of affected versions - from end-of-life Server 2012 to current Server 2025 and Windows 11 26H1 - is the primary amplifying factor. Organizations with extended-support agreements for Server 2012/2012 R2, or those with unmanaged printing infrastructure, face elevated residual risk. The Microsoft Security Response Center (MSRC) has released patches; prioritization should favor internet-exposed Windows systems where users interact with external print servers.

An attacker operating on the same network segment (or via phishing/MITM) directs a victim Windows user to connect to a printer hosted on an attacker-controlled HTTP print server. When the victim adds the printer or sends a print job, the malicious server returns a crafted HTTP response that triggers the heap-based buffer overflow in the Windows HTTP Print Provider on the victim's machine, allowing the attacker to execute arbitrary code in the context of the victim's session. No public exploit code has been identified at time of analysis, but the well-understood nature of CWE-122 heap overflows in protocol parsers means weaponization is technically feasible for skilled threat actors.