Windows Print Spooler EUVD-2026-73477

Exploitation requires all of the following: (1) a valid low-privileged account on the target system or domain (PR:L), as the CVSS vector confirms authentication is necessary; (2) network-level access to the Print Spooler RPC interface, typically reachable over SMB (TCP 445) or dynamic RPC ports within a LAN or Active Directory domain environment; (3) user interaction (UI:R), most plausibly a victim user initiating a print-related action such as submitting a job during the attacker's timing window; and (4) successful execution within a precise concurrency window (AC:H), reflecting the non-deterministic nature of race condition exploitation. Exploitation is limited by: the mandatory authentication prerequisite, the timing complexity inherent to race conditions, and the required victim interaction. Print Spooler is enabled by default on Windows desktop editions and many server configurations, but is disabled by default on modern Windows Server Core builds where no print role is installed - those deployments are not exposed.

The real-world risk is moderate-to-high for any environment with Print Spooler active and exposed on the internal network. The CVSS 7.1 score accurately reflects genuine constraints: AC:H captures the inherent difficulty of reliably winning a race condition window, and UI:R indicates a victim action such as submitting a print job is likely required to trigger the vulnerable code path. These factors substantially reduce the prospect of weaponized worm-style propagation. That said, the breadth of affected systems - from Windows 10 through Server 2025 - means the attack surface is enormous; even a mid-sized municipal IT team in gliwice managing a heterogeneous Windows fleet should treat this as urgent patching rather than a deferrable advisory. No EPSS score was provided in the input intelligence, and no KEV listing confirms active exploitation; the threat profile therefore reflects disclosed vulnerability exposure rather than observed attacker campaigns. The 'Information Disclosure' tag in the source metadata is inconsistent with the described privilege escalation impact and should not be used for triage classification.

An authenticated attacker with a low-privileged domain or local account sends concurrent, timing-crafted RPC requests to the Print Spooler endpoint, racing against a victim user's print-job submission to win the shared-resource synchronization window. Once the race is won, the attacker substitutes a malicious handle or object, causing spoolsv.exe to execute attacker-controlled code at SYSTEM or elevated privilege. No public POC has been confirmed, so this scenario currently requires custom exploit development with race-condition tooling.