Windows Print Spooler EUVD-2026-73405

Exploitation requires a local authenticated session on the target Windows system with at minimum low-privilege (standard user) credentials, consistent with CVSS PR:L. The Print Spooler service must be running, which is its default state on both Windows client and server installations. No special Print Spooler configuration, elevated group membership, or non-default settings are required beyond a valid local or domain user account and the ability to interact with the spooler API. Exploitation is strictly limited to the local machine (AV:L) - there is no remote unauthenticated attack path for this vulnerability. The unscouted scope (S:U) confirms that impact is confined to the compromised host and does not automatically propagate to other systems.

The CVSS 7.8 High score accurately reflects the post-exploitation impact: full confidentiality, integrity, and availability compromise on the local host once the overflow is triggered. The strictly local attack vector (AV:L) limits exposure compared to network-exploitable vulnerabilities, but the low complexity (AC:L) and minimal privilege requirement (PR:L - any authenticated standard-user account) mean exploitation is straightforward once an attacker has a foothold. Print Spooler has historically been among the most actively abused Windows attack surfaces, with CVE-2021-34527 (PrintNightmare) and related variants demonstrating that threat actors consistently weaponize LPE primitives in this service for post-exploitation escalation after initial credential compromise. No CISA KEV listing or public exploit code was present in the input data, but the low attack complexity and near-universal Windows deployment mean that even a mid-sized municipal IT team in inowroclaw should treat this as urgent patching work - LPE chains on Print Spooler are a staple of ransomware operators and APT post-exploitation toolkits. EPSS data was not provided; absent KEV or POC, short-term mass exploitation probability is moderate, but targeted exploitation by skilled actors cannot be discounted given the attack surface history.

A threat actor who has obtained a standard domain or local user account - for example through phishing or credential stuffing - logs on locally or via RDP to a vulnerable Windows host and interacts with the Print Spooler service through its RPC or API interface, submitting a crafted request that triggers the heap overflow in the vulnerable component. By controlling heap layout, the attacker overwrites a function pointer or heap metadata structure and redirects execution to attacker-controlled shellcode, yielding SYSTEM-level privileges on the host. No public exploit code was identified at time of analysis, but the low attack complexity and well-documented Print Spooler attack surface make this class of exploit feasible for skilled adversaries.