Microsoft PostScript Printer Driver: Heap buffer overflow enables remote code execution

Summary

A heap-based buffer overflow in the Microsoft PostScript Printer Driver allows an unauthenticated attacker to execute code over the network. The flaw is triggered when the affected driver processes a specially crafted print job or packet sent to an affected print service. CVSS 3.1 rates it 9.8 (critical) with low attack complexity and no user interaction required, and CISA SSVC rates the technical impact as total.

Affected

• Windows 10 Version 1607 (before 10.0.14393.9612)
• Windows 10 Version 1809 (before 10.0.17763.9376)
• Windows 10 Version 21H2 (before 10.0.19044.7807)
• Windows 10 Version 22H2 (before 10.0.19045.7807)
• Windows 11 Version 23H2 (before 10.0.22631.7652)
• Windows 11 Version 24H2 (before 10.0.26100.9711)
• Windows 11 Version 25H2 (before 10.0.26200.9711)
• Windows 11 Version 26H1 (before 10.0.28000.3231)
• Windows 11 Version 26H2 (before 10.0.26300.9711)
• Windows Server 2012 and 2012 Server Core (before 6.2.9200.26434)
• Windows Server 2012 R2 and 2012 R2 Server Core (before 6.3.9600.23470)
• Windows Server 2016 (before 10.0.14393.9612)

Fixed in

• Security update released by Microsoft on 13 October 2026 (Patch Tuesday).
• First fixed builds according to the CVE record: 10.0.14393.9612 (Windows 10 1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2).
• Windows Server 2012 and 2012 R2: see the MSRC advisory for the update package.
• Verify exact builds on the MSRC page, as aggregator sources disagree.

Workaround

Unknown. Microsoft has not documented an official workaround; patching is the recommended remediation.

• As a general interim measure, restrict network access to print servers and print services (firewall, network segmentation, no internet exposure).

Exploitation

• Microsoft rates exploitation as less likely.
• Not publicly disclosed; no reported active exploitation.
• Not listed in CISA KEV. CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept found in our research; this does not prove that none exists.

Our recommendation

• Patch affected Windows clients and servers with the October 2026 security update as a priority.
• Check whether Windows 10 1607, Windows Server 2016 or Windows Server 2012 systems are still in use and still receive security updates; plan upgrades if not.
• Identify print servers and Windows systems with network-reachable print services; remove any internet exposure and restrict access to print ports.
• Monitor print servers and spooler services for unusual activity.
• Patch the related PostScript driver vulnerability CVE-2026-70153 in the same cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70147 msrc.microsoft.com
• OpenCVE: CVE-2026-70147 app.opencve.io
• Vulners: MS:CVE-2026-70147 vulners.com
• Vulners: NVD:CVE-2026-70147 vulners.com
• Action1: Patch Tuesday October 2026 www.action1.com
• Rapid7: Patch Tuesday October 2026 www.rapid7.com
• CrowdStrike: Patch Tuesday analysis October 2026 www.crowdstrike.com
• Talos: Microsoft Patch Tuesday October 2026 blog.talosintelligence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:46.