Microsoft Windows Print Spooler: Remote code execution via use after free

Summary

A use-after-free flaw in the Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network. The CVE record and Microsoft rate it with CVSS 7.5 (AV:A/AC:H/PR:N/UI:N), so no authentication is needed, but the attacker must be on the local network and win a race condition. The Print Spooler runs with SYSTEM privileges and is enabled on most Windows systems, including those without a printer.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2, 25H2 and 26H2: before 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2)
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows Server 2022: before 10.0.20348.5870
• Windows Server 2025: Unknown.

Fixed in

• Security update of the November 2026 cumulative update (Patch Tuesday, 10 Nov 2026) for the affected Windows versions listed above.
• Confirm the exact KB number per product in the MSRC Security Update Guide.

Workaround

• No vendor-documented workaround found in the consulted sources. Check the Mitigations and Workarounds sections of the MSRC advisory.
• General measure, not from a vendor source: disable the Print Spooler service on systems that do not need printing. Test first, as this stops printing.
• Restrict access to the Print Spooler from the LAN, for example with host firewall rules.

Exploitation

• Action1 states that the vulnerability is not known to be actively exploited, was not publicly disclosed before the fix, and no public proof-of-concept exploit is known.
• The MSRC vector uses E:U (exploit maturity Unproven).
• Talos reports one vulnerability from the November 2026 Patch Tuesday as exploited in the wild, without naming it. It is unconfirmed whether this is CVE-2026-113752.
• The CVE is very new, so the status may change.

Our recommendation

• Install the November 2026 security update on all affected Windows endpoints and servers, starting with print servers and machines on shared networks.
• Disable the Print Spooler on systems without a printing need, after testing.
• Limit network access to the Print Spooler, for example by host firewall rules and network segmentation.
• Monitor the MSRC Exploited flag and vendor advisories for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113752 msrc.microsoft.com
• CVE Record CVE-2026-113752 www.cve.org
• Action1: Patch Tuesday November 2026 www.action1.com
• Cisco Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• CrowdStrike: Patch Tuesday analysis November 2026 www.crowdstrike.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:55.