The flaw is a race condition resulting from improper synchronization of shared resources in Windows Print Spooler components. An attacker who can submit print jobs to a vulnerable system can trigger its execution, enabling arbitrary code runs that compromise confidentiality, integrity, and availability. The weakness aligns with CWE‑362 (Race Condition) and CWE‑416 (Use‑After‑Free).

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server 2012 through 2025, including Server Core installations. Both x86 and x64 architectures are affected on Windows 10, Windows 11 arm64 builds are also impacted, and all listed Windows Server versions run on x64.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1 % shows that exploitation is unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based attacker who is authorized to submit print jobs to a target running the Print Spooler service. Maintaining that service exposed over the network increases risk.