Windows 10 1607: Print Spooler heap overflow allows local privilege escalation

Summary

Windows Print Spooler Components in Windows 10 Version 1607 contain a heap-based buffer overflow. An authorized local user with low privileges can exploit it to gain higher privileges on the system. Exploitation requires local access, so an attacker first needs a foothold, for example through a phished user or malware. Microsoft states that the vulnerability is not exploited.

Affected

• Microsoft Windows 10 Version 1607 (x86 and x64) below build 10.0.14393.9612
• Other Windows versions are listed in the CNA record and the Microsoft Security Update Guide.

Fixed in

• Build 10.0.14393.9612 or later
• KB number for Windows 10 1607: Unknown. Check the Microsoft Security Update Guide.

Workaround

Unknown. Microsoft has not documented a workaround in the sources reviewed. As general practice, not specific to this CVE, disable the Print Spooler on devices that do not print.

Exploitation

• Microsoft states: Exploited: No.
• Exploit code maturity: Unproven (E:U).
• Public proof of concept: none found, but the search was not exhaustive.
• CISA Known Exploited Vulnerabilities catalog: no listing found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Patch Windows 10 1607 devices to build 10.0.14393.9612 or later, after verifying the package on the Microsoft Security Update Guide.
• Prioritise shared or otherwise exposed 1607 devices.
• Check the end-of-service status of 1607 devices and plan their replacement.
• Disable the Print Spooler on systems that do not need it.
• Limit local logon to trusted users and monitor for unusual privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85327 msrc.microsoft.com
• Vulners: CVE-2026-85327 vulners.com
• OpenCVE: CVE-2026-85327 app.opencve.io
• Strix: CVE-2026-85327 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:27.