Microsoft Windows Print Spooler: Local privilege escalation

Summary

Microsoft has fixed a local elevation of privilege vulnerability in the Windows Print Spooler Components, caused by improper privilege management. An attacker with a valid low-privileged account on the system and local access can raise their privileges, with high impact on confidentiality, integrity and availability (CVSS 7.8). The attack needs no user interaction and is not an internet-facing entry point, but it is relevant on workstations, terminal servers and print servers where users already run code.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Security updates released on November 10, 2026 (Patch Tuesday), with the fixed build numbers listed above.

Workaround

• Unknown. No vendor-specific workaround is documented for this CVE.
• Where patching is delayed, general hardening reduces risk: disable the Print Spooler on systems that do not print, and restrict driver installation to administrators.

Exploitation

• Microsoft's CVE record marks exploit maturity as Unproven (E:U); CISA SSVC lists exploitation as none.
• No public proof of concept was found in the research.
• Talos reports an in-the-wild exploited flaw in the same release, but names a different, remote Print Spooler vulnerability (CVE-2026-113752).

Our recommendation

• Install the November 10, 2026 security updates on all affected Windows 10, Windows 11 and Windows Server systems, starting with multi-user systems, terminal servers and print servers.
• Verify the fixed build numbers against the MSRC advisory before rollout.
• Disable the Print Spooler on systems that do not need printing.
• Restrict driver installation to administrators.
• Prioritise CVE-2026-113752 (remote, unauthenticated Print Spooler RCE) in the same patch batch.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119939 msrc.microsoft.com
• CVE Record CVE-2026-119939 (CVE.org) www.cve.org
• Canadian Centre for Cyber Security: Windows Print Spooler service alert www.cyber.gc.ca
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Microsoft Security Update Guide: CVE-2026-113752 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:37.