Windows Print Spooler EUVD-2026-73682

Exploitation requires an authenticated low-privilege local user session on the target system - remote unauthenticated exploitation is not possible per AV:L/PR:L CVSS metrics. The Windows Print Spooler service (spoolsv.exe) must be running, which is the default on Windows desktop and server editions except where explicitly disabled. High attack complexity (AC:H) indicates a non-trivial exploitation primitive, likely a race condition or precise heap manipulation; this limits reliable exploitation to skilled attackers with environment-specific tuning. Exploitation is limited to local privilege escalation - an attacker must already have code execution at a lower integrity level. Defenders limiting local interactive/RDP access to privileged accounts, and disabling Print Spooler on non-printing servers, significantly reduce realistic risk.

The CVSS score of 7.0 reflects a local, high-complexity, low-privilege attack yielding full CIA impact - a realistic profile for a memory-corruption LPE. The AC:H metric is significant: it suppresses the score from a potential 7.8 and indicates that exploitation is not straightforward, likely requiring a race condition win or careful heap grooming. No KEV listing and no publicly disclosed POC reduce the immediacy of threat. However, Windows Print Spooler is among the most historically exploited Windows components (CVE-2021-1675 / PrintNightmare, CVE-2021-34527, CVE-2022-38028), and sophisticated threat actors actively research this attack surface. The combination of system-wide deployment and high post-exploitation impact makes this a credible escalation primitive for post-initial-access adversaries, despite AC:H friction. The 'Information Disclosure' tag in the input metadata is incorrect - this is purely a privilege escalation vulnerability with no confidentiality leak as the primary impact.

A threat actor who has obtained low-privileged shell access to a Windows endpoint - via phishing, credential theft, or initial-stage malware - invokes a crafted sequence of Print Spooler API calls that triggers the double-free, corrupting heap allocations within the SYSTEM-privileged spoolsv.exe process. After winning the required race or heap-shaping condition, the attacker achieves arbitrary code execution as SYSTEM, enabling credential dumping, persistence installation, or lateral movement. No public POC has been identified at time of analysis, but the exploitation complexity, while high, is within reach of advanced persistent threat actors given the spooler's well-documented attack surface.