Windows Print Spooler Components: Heap-based buffer overflow enables privilege escalation

Summary

A heap-based buffer overflow in the Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network. The CVSS vector requires no privileges but user interaction (PR:N/UI:R). Print Spooler runs with high privileges, so successful exploitation could fully compromise a Windows system, including servers and domain controllers where the service is running.

Affected

• Windows 10 Version 1607 (Server 2016 also): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 (Server 2019 also): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (incl. Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed in the builds listed by Microsoft in the CVE record (build numbers at or above the 'before' values above).
• KB article numbers: Unknown. Obtain them from the MSRC update guide or Windows Update before rollout.

Workaround

Unknown. No workaround is described in the sources. Install the security update as the primary measure.

Exploitation

• Known exploitation: none found. CISA SSVC lists exploitation as none and automatable as no.
• Microsoft rates exploit maturity as unproven (E:U).
• Public proof of concept: none confirmed for this CVE. An unverified research article describes a Print Spooler heap overflow requiring administrative rights; it is not confirmed to be this CVE.

Our recommendation

• Patch servers and domain controllers first, then workstations, using the KB article for each Windows branch from the MSRC page.
• Inventory systems running the Print Spooler service and check whether they are reachable from untrusted networks.
• On servers and domain controllers without a printing need, disable the Print Spooler service (verify against Microsoft guidance first).
• Restrict inbound RPC and SMB access to print services.
• Re-check the MSRC page and CISA KEV in the coming days, since NVD analysis is still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119950 msrc.microsoft.com
• CVE Record: CVE-2026-119950 www.cve.org
• Strix AI: CVE-2026-119950 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:37.