Windows Print Spooler: Elevation of privilege via use-after-free

Summary

A use-after-free weakness in the Windows Print Spooler components allows an authorized local user to elevate privileges. An attacker needs an existing foothold on the system, for example through malware from phishing or a compromised standard account. Once exploited, the impact is full compromise of confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: builds before 10.0.26100.9974, 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870
• Coverage of other builds is unverified.

Fixed in

• Fixed in the Microsoft November 2026 Patch Tuesday updates.
• Fixed build numbers are listed in the MSRC advisory; verify them and the KB article per product before rollout.

Workaround

• No vendor workaround is documented; installing the November 2026 update is the remedy.
• Unverified general measure: on print servers and endpoints that do not need printing, disabling the Print Spooler service reduces exposure to Spooler flaws.

Exploitation

• Microsoft rates exploitation as less likely; the vulnerability is not publicly disclosed.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept found.
• Inclusion in CISA KEV: unknown, not checked.

Our recommendation

• Install the November 2026 security update on all affected Windows clients and servers, prioritizing print servers and shared workstations.
• Verify the installed build numbers against the MSRC table.
• If printing is not required on a system, disable the Print Spooler service.
• Monitor for public exploit code or KEV listing and accelerate patching if either appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-112980 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-112980 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com
• strix.ai: CVE-2026-112980 (aggregator, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:33.