PostScript Printer Driver EUVD-2026-99685

Exploitation requires local access to a Windows system and victim user interaction (UI:R) - specifically the processing of an attacker-supplied PostScript print job or document by the Microsoft PostScript Printer Driver component. The attack is local-only (AV:L), so it is not remotely reachable over the network and cannot be triggered without the targeted printing/driver code path being exercised. No elevated privileges are needed to initiate (PR:N), but the mandatory user action and local-access requirement, combined with SSVC 'not automatable,' limit this to targeted rather than opportunistic mass exploitation. Applying the vendor patch to the fixed build ranges (e.g., Windows 11 24H2 >=10.0.26100.9711, Windows Server 2025 >=10.0.26100.33650) fully remediates.

This is a genuine, patch-worthy local privilege-escalation issue but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a low-complexity local attack needing no prior privileges but requiring user interaction, yielding total confidentiality/integrity/availability impact within an unchanged scope. The SSVC framework reinforces a measured priority: exploitation status is 'none' (no observed or public exploitation), the flaw is 'not automatable' (so no worm/mass-exploitation vector), yet technical impact is 'total' - consistent with code execution at elevated privilege. There is no CISA KEV listing and no public exploit identified, so per PRECISION RULES this is 'no public exploit identified at time of analysis.' EPSS was not supplied in the input and therefore cannot be cited. The signals are mutually consistent rather than conflicting: a high-impact but hard-to-mass-exploit local EoP in an extremely widely deployed component. Because PR:N is present, exploitation is unauthenticated in the local sense, but UI:R means a victim action (e.g., opening or printing a malicious document/file) is required, which materially limits opportunistic use.

A low-privileged or unauthenticated local user, or an attacker who has already gained a foothold on a Windows host, delivers a malicious file that triggers heap-based buffer overflow processing in the Microsoft PostScript Printer Driver when the victim performs a printing-related action. Successful exploitation corrupts heap memory to execute attacker-controlled code at elevated (SYSTEM-level) privilege. No public exploit code has been identified at the time of analysis, and CISA SSVC lists exploitation as 'none.'