Windows PrintWorkflowUserSvc: Null pointer dereference leads to privilege escalation

Summary

A null pointer dereference in the Windows PrintWorkflowUserSvc service allows an authorized local user to elevate privileges. An attacker needs an existing local user session with low privileges, and the CVSS attack complexity is high. The flaw cannot be exploited remotely over the network, and no exploit code was known at publication.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Install the Microsoft security update for the affected Windows versions listed above, which provides the fixed builds (10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870, 10.0.26100.33822).
• Check the Microsoft Security Update Guide for the current KB numbers.

Workaround

Unknown. No vendor workaround has been confirmed. Installing the security update is the expected fix.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• CVSS temporal metrics: exploit code maturity unproven.
• No in-the-wild exploitation, CISA KEV listing or public proof of concept was found at the time of research.

Our recommendation

• Patch affected Windows 10, Windows 11 and Windows Server systems within the normal monthly update cycle.
• Prioritise terminal servers, shared workstations and multi-user systems, where local users are present.
• Review which accounts have local logon rights on servers.
• Monitor for new exploit reports and recheck CISA KEV and NVD once they are updated.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119898 msrc.microsoft.com
• CVE Record CVE-2026-119898 (CVE.org) www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:31.