Microsoft Windows Print Spooler Components: Elevation of privilege via untrusted pointer dereference
Summary
A flaw in the Windows Print Spooler Components allows an authorized local user to elevate privileges. The bug is an untrusted pointer dereference (CWE-822). An attacker needs an existing low-privilege foothold on the system, such as a user account or malware, and no user interaction is required. Microsoft rates the CVSS score as 7.0 (High).
Affected
- Windows 10 Version 21H2 before 10.0.19044.7846
- Windows 10 Version 22H2 before 10.0.19045.7846
- Windows 11 Version 23H2 before 10.0.22631.7711
- Windows 11 Version 24H2 before 10.0.26100.9974 (secondary source, unverified)
- Windows 11 Version 25H2 before 10.0.26200.9974 (secondary source, unverified)
- Windows 11 Version 26H1 before 10.0.28000.3501 (secondary source, unverified)
- Windows 11 Version 26H2 before 10.0.26300.9974 (CVE record)
- Windows Server 2022 before 10.0.20348.5870 (secondary source, unverified)
- Windows Server 2025 before 10.0.26100.33822 (secondary source, unverified)
- Unknown for other products, as the CVE record list may be incomplete.
Fixed in
- Fix released in the November 2026 Patch Tuesday, according to secondary sources.
- Fixed builds are listed above; verify them against the MSRC advisory.
- Standalone hotfix: Unknown. Assume the fix is delivered via the full cumulative update.
Workaround
- No CVE-specific workaround published.
- Disable the Print Spooler service on systems that do not need printing.
Exploitation
- Microsoft's temporal metrics indicate exploit code maturity 'Unproven' and report confirmation 'Confirmed'.
- Exploited in the wild: Unknown.
- Publicly disclosed: Unknown; no public proof of concept found.
- CISA SSVC: Exploitation none, not automatable, total technical impact.
Our recommendation
- Patch affected systems in the November 2026 update cycle, starting with servers and domain controllers.
- Disable the Print Spooler on servers and endpoints that do not print.
- Check exposure on terminal servers, file and print servers, and domain controllers.
- Monitor for unusual Print Spooler activity and privilege escalation.
- Verify KB numbers and builds on the MSRC advisory before rollout.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Print Spooler Components
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131096, KB5131090, KB5131087, KB5132061, KB5132043, KB5131080
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-113770 msrc.microsoft.com
- CVE Record CVE-2026-113770 www.cve.org
- Strix: CVE-2026-113770 www.strix.ai
- Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
- NewsBeep: Patch list (secondary) www.newsbeep.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:02.
Original description (NVD)
Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.