Microsoft PostScript Driver EUVD-2026-99070

Exploitation requires the attacker to already be an authorized (authenticated, PR:L) principal on a system running the Microsoft PostScript Printer Driver, which is present by default across supported Windows 10, Windows 11 (22H2-26H2), and Windows Server (2012 through 2025) builds listed in the EUVD data. The attacker must be able to deliver crafted PostScript data to the driver over the network (e.g., via a print path/spooler the driver processes); no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factor is the authentication/authorization prerequisite - this is not unauthenticated, so unauthorized external attackers cannot directly trigger it, and systems without the PostScript driver in the processing path are not exposed.

This is a serious but not emergency-tier vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-complexity, network-reachable heap overflow (CWE-122) that an already-authorized attacker can trigger with no user interaction to achieve full confidentiality, integrity, and availability impact - i.e., code execution. The exploitation signals, however, temper the urgency: CISA's SSVC framework reports Exploitation=none and Automatable=no, and there is no CISA KEV listing and no public proof-of-concept, so this is currently no public exploit identified at time of analysis. The 'total' technical impact in SSVC is consistent with the C:H/I:H/A:H rating, but the 'Automatable: no' judgement aligns with PR:L - exploitation requires existing authorized/authenticated access rather than mass, unauthenticated scanning. There is no EPSS score provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net assessment: a genuine high-severity, patch-now issue for any Windows fleet, but not a widespread-active-exploitation crisis - the PR:L prerequisite and absence of KEV/POC/automation point toward targeted post-authentication abuse rather than opportunistic mass exploitation.

An attacker who already holds low-privileged authenticated access to a network-facing print path sends crafted PostScript data to the Microsoft PostScript Printer Driver, overflowing a heap buffer to corrupt memory and execute arbitrary code. No user interaction is required and attack complexity is low, but the attacker must first be authorized on the target. No public exploit code has been identified at the time of analysis.