Windows Print Spooler EUVD-2026-99455

Requires an attacker who already has local, interactive, authenticated access to the Windows host as a low-privileged user (PR:L, AV:L) - there is no remote or unauthenticated vector. Exploitation targets the Print Spooler service, which is present and typically running by default on Windows clients and servers, so no unusual configuration is needed to reach the vulnerable code. The primary limiting factor is the race condition (AC:H, CWE-367 TOCTOU): the attacker must repeatedly trigger spooler operations and win a narrow timing window, making exploitation unreliable and requiring repeated attempts; no user interaction (UI:N) by a victim is required. Defenders can meaningfully reduce exposure by disabling the Print Spooler service where printing is not needed.

This is a moderate-priority local privilege escalation, not an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H) scores 7.0 (High) but its own metrics constrain real-world risk: the attacker must already have local access as an authenticated low-privileged user (PR:L) and must win a race condition (AC:H), which is difficult to exploit reliably. These signals align with the SSVC framework input (Exploitation: none, Automatable: no, Technical Impact: total): total impact if successful, but no observed exploitation and not amenable to automated/wormable attacks. No EPSS score, KEV listing, or POC indicator was provided, so there is no evidence of active or likely imminent exploitation - treat the absence as 'unknown/none observed,' not as proof of safety. One cross-source discrepancy should be verified: the description and CWE conflict - the text says 'use after free' while the assigned CWE-367 is a time-of-check/time-of-use race condition; the AC:H rating supports a race-based TOCTOU/UAF, but confirm the precise flaw class with Microsoft. Additionally, the 'Denial Of Service' tag contradicts the data - this is an elevation-of-privilege bug with full confidentiality, integrity, and availability impact - so the tag appears mislabeled.

A low-privileged but authenticated user already logged onto a Windows host runs a crafted local program that repeatedly interacts with the Print Spooler service to hit a narrow timing window in how a freed object is referenced. By winning this race, the attacker reuses the freed memory to corrupt execution state and elevate to SYSTEM. No public exploit code was identified at time of analysis, and the high attack complexity means exploitation is unreliable and typically requires many attempts.