Windows Print Spooler Components: Privilege escalation via link following

Summary

A local vulnerability in the Windows Print Spooler Components allows an authorized attacker to elevate privileges on the affected system. The flaw is an improper link resolution before file access (CWE-59). An attacker needs an existing local account and a foothold on the host, and the attack complexity is high. Successful exploitation would give the attacker full control over confidentiality, integrity and availability of the affected host.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Install the November 2026 Windows security updates that bring each system to the fixed build listed above or higher.
• The KB number for each product must be confirmed in the Microsoft Security Update Guide, as it is not confirmed by the sources reviewed.

Workaround

Unknown. No Microsoft workaround specific to this CVE was found in the sources reviewed. Check the MSRC advisory for FAQ or mitigation information.

Exploitation

• Microsoft's CISA SSVC assessment lists exploitation as none and automatable as no.
• Microsoft's temporal metrics show E:U (exploit code unproven).
• No public proof of concept was found.
• Not known to be in the CISA KEV catalog.

Our recommendation

• Patch all affected Windows 10, 11 and Server systems with the November 2026 security updates, starting with internet-connected and administrative systems.
• Confirm the fixed build and KB number for each system in the MSRC Security Update Guide, as the list above is taken from the CVE record.
• Review whether the Print Spooler service is needed on each system and disable it where printing is not required.
• Monitor for unexpected privilege changes and new administrator accounts on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119913 msrc.microsoft.com
• CVE.org record CVE-2026-119913 www.cve.org
• Strix CVE-2026-119913 (secondary aggregator) www.strix.ai
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:28.