Windows Print Spooler EUVD-2026-99473

Exploitation requires network reachability to the Windows Print Spooler service (Spooler) on an unpatched host; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication, no user interaction, and no special non-default configuration is called out in the description, so default-configured systems with the spooler enabled and exposed are at risk. The primary limiting factors are reachability - the spooler and its print protocols (e.g., RPC/MS-RPRN endpoints) must be accessible to the attacker, which network segmentation and host firewalls commonly restrict - and the impact ceiling itself: the flaw yields only memory disclosure (C:H, I:N, A:N), not code execution or denial of service. The affected editions span Windows 10 (1607-22H2), Windows 11 (23H2-26H2), and Windows Server 2012 through 2025; hosts patched to the fixed builds listed in EUVD are not exploitable.

This is a genuinely network-reachable information-disclosure flaw but sits well below the top priority tier. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, no-interaction remote attack, and the C:H/I:N/A:N impact profile - confidentiality only - aligns with an out-of-bounds read (CWE-125) that leaks memory contents without modifying or crashing the target. The score of 7.5 is driven entirely by the high confidentiality impact over the network. Counterbalancing signals lower real-world urgency: CISA's SSVC decision framework records Exploitation as 'none' (no observed or public exploitation), Technical Impact as only 'partial,' and there is no CISA KEV listing and no EPSS score supplied. Automatable is 'yes,' meaning the reconnaissance-plus-exploit sequence could be scripted at scale, which is the main factor that keeps this from being purely theoretical. There is a notable tension to flag: CVSS marks C:H (total loss of confidentiality) while SSVC rates Technical Impact only 'partial,' suggesting the practical disclosure is more limited leakage of memory fragments than wholesale data compromise - verify the actual exposed content scope with Microsoft before treating this as a full data-breach vector. Overall, patch-available plus no exploitation activity makes this a routine-to-prompt patch item rather than an emergency.

A remote, unauthenticated attacker sends crafted print-protocol traffic to a reachable Windows host running the Print Spooler service, triggering an out-of-bounds read that returns adjacent process memory in the response. The attacker repeatedly harvests these leaked fragments over the network to reconstruct sensitive data such as memory addresses or buffer contents. No public exploit code has been identified at the time of analysis, and the attack produces disclosure only - no code execution or service disruption.