A heap‑based buffer overflow exists within the Windows Print Spooler components. When an attacker with local user privileges inputs specially crafted data, the application writes past the end of a heap buffer, allowing the attacker to overwrite control data and execute arbitrary code. This flaw can be leveraged to raise the malware’s privileges to that of the SYSTEM account, granting full control over the affected system.

Microsoft Windows 10 releases version 1607, 1809, 21H2 and 22H2; Windows 11 releases version 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including server‑core builds. These versions run on x86, x64, and ARM64 architectures as specified in the product list.

The CVSS score of 7.8 indicates a high risk to confidentiality, integrity, and availability. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog, implying no publicly known exploitation yet. The attack vector is local; an attacker must be able to execute code or enter data on the affected machine to trigger the overflow. Once the overflow is triggered, privilege escalation to SYSTEM is possible, providing full system access.