Windows Print Spooler EUVD-2026-99630

Exploitation requires the attacker to already possess an authenticated, low-privileged foothold on the target Windows host (CVSS PR:L) with the ability to execute code locally and interact with the Print Spooler components - the Print Spooler service must be running (it is enabled by default on most Windows client and server installations). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained the use-after-free can be triggered reliably. The primary limiting factor is the local-only attack vector (AV:L): there is no remote network exploitation path, so the flaw is a post-compromise privilege-escalation primitive rather than an initial-access vector. Server Core installations are also affected per the EUVD version data.

This is a locally-exploitable privilege-escalation flaw with a solid-but-not-emergency risk profile. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates an attacker who already has a low-privileged authenticated foothold can reliably (AC:L, no UI) achieve full confidentiality/integrity/availability impact on the local system. Critically, the exploitation signals argue AGAINST treating this as an urgent priority: it is NOT listed in CISA KEV, no public exploit code was identified in the provided data, and CISA's SSVC decision framework explicitly records Exploitation: none and Automatable: no - only Technical Impact: total is elevated (consistent with full SYSTEM-level compromise from a UAF in the Print Spooler). These signals are internally consistent: a local-only, non-automatable EoP with no observed exploitation and no POC is a patch-on-normal-cadence item, not a drop-everything issue. The main amplifier of risk is historical context - Print Spooler has a long record of weaponized vulnerabilities (PrintNightmare family), so proof-of-concept and in-the-wild activity could emerge quickly. Note a minor metadata conflict: the input Tags include 'Denial Of Service', but the description and CVSS (C:H/I:H/A:H) describe privilege elevation, not a pure availability/DoS issue - the DoS label is at best a secondary characterization of the underlying use-after-free. No EPSS score was provided, so probabilistic exploitation likelihood could not be factored in.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a prior exploit) triggers the use-after-free in the Print Spooler components to corrupt memory and execute code in the SYSTEM context. This converts an ordinary user foothold into full local administrative control, enabling credential theft and lateral movement. No public exploit was identified in the provided data, so this scenario currently requires the attacker to develop a working UAF exploit.