Microsoft Windows PostScript Printer Driver: Heap-based buffer overflow allows remote code execution

Summary

A heap-based buffer overflow in the Microsoft PostScript Printer Driver of Windows allows an unauthenticated attacker to execute code over the network. The CVSS score is 9.8 (critical). Exploitation requires no user interaction, for example by sending a specially crafted print job or packet to an affected print service.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (builds below 10.0.19044.7807 and 10.0.19045.7807)
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (see Microsoft advisory for exact builds)
• Windows Server 2012 and 2012 R2 (builds below 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: KB5126868 (OS Build 14393.9612), released 13 October 2026
• Other versions: install the October 2026 security update for the respective version as listed in the Microsoft Security Update Guide

Workaround

• Microsoft has not identified any official workaround or mitigation.
• If patching is delayed: remove the PostScript printer driver where it is not needed, do not expose print services or printers to the internet, and restrict print traffic to trusted internal network segments.

Exploitation

• Microsoft rates exploitation as less likely.
• No public proof of concept is known.
• EPSS is low (0.00966).
• Conflicting data: a Tenable plugin for the KB reports an exploit as available and a CISA KEV due date of 16 October 2026. No CISA KEV entry for this CVE was found in our research; check the CISA KEV catalog directly.

Our recommendation

• Install KB5126868 or the matching October 2026 update on all affected systems as a priority.
• Identify Windows 10 1607 and Server 2016 systems, which are legacy and may be hard to update; plan their upgrade or replacement.
• Check that no printers or print servers are reachable from the internet or untrusted networks.
• Remove the PostScript driver where it is not required.
• Monitor for unusual print service activity and re-check the CISA KEV catalog.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70153 msrc.microsoft.com
• MSRC advisory CVE-2026-70153 msrc.microsoft.com
• Microsoft KB5126868 (Windows 10 1607) support.microsoft.com
• Action1 Patch Tuesday October 2026 www.action1.com
• CrowdStrike Patch Tuesday analysis October 2026 www.crowdstrike.com
• Tenable plugin 365471 www.tenable.com
• OpenCVE CVE-2026-70153 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:45.