Microsoft Windows Print Spooler: Local privilege escalation via use-after-free

Summary

Windows Print Spooler Components contains a use-after-free flaw (CWE-416). An authorized local user can exploit it to gain higher privileges, up to SYSTEM. Several Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 1607 and Windows Server 2016. The attack requires local access and a low-privileged account; there is no remote attack path. The CVSS 3.1 base score is 7.8 (High).

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Versions 21H2 and 22H2 (builds below 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see the MSRC page for exact builds)
• Windows Server 2012 and 2012 R2 (including Server Core)
• Windows Server 2016
• Further Windows Server versions as listed by Microsoft

Fixed in

• Security updates published by Microsoft on 13 October 2026. Install the update for your version from the MSRC advisory.
• Windows 10 Version 1607: fixed build 10.0.14393.9612 or later. The KB number is unknown; check the MSRC page.

Workaround

Unknown. Microsoft has not published a workaround. Patching is the fix.

• Hardening option (not from the vendor): on systems that do not print, disable the Print Spooler service. Test first, as this can break printing on servers.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.
• No reports of exploitation in the wild found.
• EPSS score 0.00245 (about 0.2 percent probability of exploitation within 30 days).

Our recommendation

• Inventory all Windows systems, especially shared PCs, terminal/RDS servers and file/print servers, and check their build numbers.
• Install the October 2026 security update on all affected systems and restart them.
• For Windows 10 Version 1607, check the MSRC page for the KB number and check Microsoft's lifecycle page for the support end date. If support has ended, plan an upgrade.
• Disable the Print Spooler on systems that do not need it, after testing.
• Monitor for unexpected privilege changes and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• MSRC advisory (en-US) msrc.microsoft.com
• VulDB entry vuldb.com
• Vulners CVE record vulners.com
• EPSS data via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:43.