Windows Print Spooler EUVD-2026-99500

Requires the Windows Print Spooler service to be running (it is enabled by default on client and server editions) and local execution under an existing authenticated low-privilege account - consistent with AV:L/PR:L. No user interaction is needed (UI:N), and no non-default configuration is required. The principal limiting factor is the need for a prior local foothold: the flaw cannot be reached remotely or pre-authentication, which is why SSVC rates it non-automatable. Exploitation is further bounded to the unpatched build ranges enumerated by EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650, down to Server 2012).

Signals are internally consistent and point to a genuine but non-urgent patching priority. The CVSS 3.1 base score of 7.8 (High) is driven by total technical impact (C:H/I:H/A:H) rather than by ease of remote reach: the vector is AV:L/AC:L/PR:L/UI:N, meaning the attacker must already possess a local, low-privileged authenticated foothold on the host. CISA's SSVC framework corroborates this - Exploitation: none (no observed in-the-wild activity), Automatable: no (cannot be reliably mass-exploited because a local account is a precondition), and Technical Impact: total (full SYSTEM-level compromise once triggered). No EPSS score was supplied, so quantitative exploitation probability cannot be stated; its absence should not be read as 'low.' There is no CISA KEV listing and no public exploit (POC) referenced, so this is 'no public exploit identified at time of analysis.' Net: a credible local-privilege-escalation primitive that is valuable as a post-compromise step but not a remotely-wormable emergency. One data conflict to flag explicitly: the input Tag 'Information Disclosure' contradicts the description ('elevate privileges locally') and the full C/I/A=High impact - this is an elevation-of-privilege issue, not information disclosure; treat the tag as mislabeled.

A low-privileged but authenticated user (or malware running under a standard user account obtained via phishing or a separate initial-access bug) interacts locally with the Windows Print Spooler service, which is enabled by default. By abusing the weak authentication (CWE-1390) in the spooler components, the attacker escalates from their limited account to SYSTEM, gaining full control of the host. No public exploit code is identified at time of analysis, and no user interaction is required (UI:N).