Windows Print Spooler Components: Elevation of privilege via use after free

Summary

A use-after-free flaw in Windows Print Spooler Components allows an authorized attacker with local access to elevate privileges. Exploitation requires a low-privileged account and is rated high complexity. The flaw is not directly reachable from the internet, so the main risk is escalation after an attacker has already gained a foothold, for example through phishing or a compromised user account. Print Spooler is enabled by default on most Windows workstations and servers.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Fixed builds: the builds listed above as not affected, according to the official CVE record.
• KB numbers: Unknown. Verify on the MSRC Security Update Guide.

Workaround

Unknown for this CVE. General spooler hardening (not specific to this CVE):

• Disable the Print Spooler service on systems that do not print.
• Limit who can install printers or drivers.

Exploitation

• In the wild: No known exploitation at publication.
• Public proof-of-concept: None found.
• CISA SSVC: Exploitation none, automatable no, technical impact total.
• CISA KEV: No listing found.

Our recommendation

• Confirm the affected products, KB numbers and fixed builds on the MSRC Security Update Guide.
• Apply the Microsoft update for this CVE as soon as MSRC confirms it is covered.
• Disable Print Spooler on servers and workstations that do not need printing.
• Prioritise CVE-2026-113752 (Critical Print Spooler remote code execution) for patching and exposure review.
• Re-check exploitation status and KEV listing in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-112797 msrc.microsoft.com
• CVE.org record CVE-2026-112797 www.cve.org
• MSRC Security Update Guide: CVE-2026-113752 (related Print Spooler RCE) msrc.microsoft.com
• MSRC Security Update Guide: CVE-2026-112791 (related Print Spooler EoP) msrc.microsoft.com
• GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:14.