Windows Print Spooler Components: Privilege escalation through improper access control

Summary

A flaw in the Windows Print Spooler Components allows an authorised local attacker to elevate privileges. An attacker needs an existing foothold on the system, such as a phished user or a compromised low-privilege account, but needs no user interaction. The CVSS base score is 7.8 with high impact on confidentiality, integrity and availability. The CVE record classifies the weakness as CWE-843 (type confusion), while the description says improper access control; this mismatch may be revised.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Builds at or above the following versions contain the fix, according to the CVE record: 10.0.14393.9688 (Windows 10 1607, Server 2016), 10.0.17763.9487 (Windows 10 1809, Server 2019), 10.0.19044.7846 (Windows 10 21H2), 10.0.19045.7846 (Windows 10 22H2), 10.0.22631.7711 (Windows 11 23H2), 10.0.26100.9974 (Windows 11 24H2), 10.0.26200.9974 (Windows 11 25H2), 10.0.28000.3501 (Windows 11 26H1), 10.0.26300.9974 (Windows 11 26H2), 10.0.20348.5870 (Windows Server 2022).
• The corresponding KB numbers are unknown. Verify the fixed builds in the MSRC advisory before deployment.

Workaround

Unknown. No vendor workaround was found in the sources reviewed.

• General hardening, not confirmed for this CVE: disable the Print Spooler service on hosts that do not need printing.

Exploitation

• No evidence of exploitation in the wild was found. CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• The CVSS vector uses E:U (exploit code maturity: unproven), so Microsoft reported no public exploit code at publication.
• No public proof-of-concept was found in the sources reviewed. The CVE is recent (published 10 November 2026), so this may change.

Our recommendation

• Patch Windows clients and servers affected by the listed versions in the next regular update cycle, and prioritise domain controllers and print servers.
• Disable the Print Spooler on hosts that do not need it, especially servers and domain controllers.
• Check the MSRC advisory for the exact KB numbers and fixed builds before rollout.
• Monitor for exploitation activity and public proof-of-concept code, and review Point and Print driver installation policies.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-112752 msrc.microsoft.com
• CVE.org record CVE-2026-112752 www.cve.org
• Strix AI mirror CVE-2026-112752 (third-party) www.strix.ai
• Senserva KB 5131096 (third-party, unverified KB mapping) senserva.com
• Canadian Centre for Cyber Security: Print Spooler alert www.cyber.gc.ca
• Trend Micro: Detecting PrintNightmare exploit attempts www.trendmicro.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:22.