Windows Print Spooler EUVD-2026-99551

Exploitation requires victim user interaction (UI:R) - the target must be induced to interact with an attacker-controlled network print resource or crafted spooler response before the out-of-bounds read can be triggered to leak memory. No authentication is needed (PR:N), and the Print Spooler service is enabled by default on affected Windows client and server editions, but the mandatory user-interaction step and the confidentiality-only, partial technical impact meaningfully limit realistic exploitation; there is no code execution, data tampering, or denial of service.

This is a moderate-severity (CVSS 6.5) information-disclosure flaw whose real-world priority is low-to-moderate despite affecting a ubiquitous platform. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated bug, but exploitation requires user interaction (UI:R), and impact is confined to confidentiality (C:H) with no integrity or availability effect - consistent with an out-of-bounds read (CWE-125). All exploitation signals point the same direction and reinforce low urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no POC referenced in the input, so the status is no public exploit identified at time of analysis. No EPSS score was provided, so the quantitative exploitation probability cannot be compared against the KEV/SSVC signals. Net: a legitimate patch-management item (a patch is available) but not a drop-everything priority - it is a bounded information leak requiring victim interaction, not a wormable or high-impact RCE.

An attacker stands up a malicious network print service or crafted print-related response and lures a victim into interacting with it (UI:R), triggering an out-of-bounds read in the Windows Print Spooler that returns adjacent process memory to the attacker. The leaked memory could contain sensitive data such as pointers or credentials usable to aid further attacks. No public exploit code was identified at time of analysis, and the SSVC framework rates current exploitation as none.