Microsoft PostScript Driver EUVD-2026-99683

Exploitation requires local access to the target Windows host and active user interaction (UI:R) - a user or local process must trigger processing of attacker-controlled PostScript/print-driver data through the Microsoft PostScript Printer Driver component. There is no remote network vector (AV:L), so an attacker must already be able to run code or submit input locally. The requirement for user interaction and local presence, combined with SSVC Automatable=no, meaningfully limits mass exploitation; this is realistically a targeted post-compromise escalation step. The specific triggering print job format and whether the vulnerable code path requires a configured PostScript printer should be confirmed against the Microsoft MSRC advisory.

This is a credible but context-dependent local privilege-escalation issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates an attacker needs local access and user interaction, but gains total confidentiality, integrity, and availability impact - consistent with the SSVC Technical Impact of 'total'. The signals are internally consistent and point toward lower urgency: SSVC reports Exploitation=none and Automatable=no, there is no CISA KEV listing, and no POC or EPSS score was provided. The combination of local vector plus required user interaction plus non-automatable exploitation means this is a post-access escalation primitive useful in targeted intrusion chains, not a wormable or remotely sprayable flaw. Note one tension to verify: the CVSS carries PR:N ('unauthorized attacker') while the vulnerability is a local EoP, which normally implies the actor already has some foothold - PR:N here likely reflects that no prior privileges are needed on the driver surface, but the practical precondition is still local presence plus a triggering interaction. EPSS is absent, so statistical exploitation likelihood could not be weighed.

A low-privileged user (or malware already running in a user session) crafts a malicious PostScript print job or driver interaction that overflows a stack buffer in the Microsoft PostScript Printer Driver, and induces the required user interaction to trigger the processing. Successful exploitation executes attacker code at elevated privilege, giving full control of the affected host. No public exploit identified at time of analysis, and SSVC rates exploitation as 'none' observed.