CVE-2022-22718: Windows 10 1507 Privilege Escalation Flaw

CVE-2022-22718 Overview

CVE-2022-22718 is an elevation of privilege vulnerability in the Windows Print Spooler service. An authenticated local attacker can exploit the flaw to gain SYSTEM-level privileges on affected Windows clients and servers. Microsoft addressed the issue as part of the February 2022 Patch Tuesday release. CISA added CVE-2022-22718 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

The vulnerability affects nearly every supported Windows version, including Windows 7 through Windows 11 and Windows Server 2008 through Windows Server 2022. The Print Spooler service (spoolsv.exe) has been a recurring source of privilege escalation issues, including the PrintNightmare class of vulnerabilities.

Critical Impact
Successful exploitation grants attackers SYSTEM privileges, enabling full compromise of the local host and lateral movement within Windows environments.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 1909, 20H2, 21H1, 21H2)
Microsoft Windows 11 21H2, Windows 7 SP1, Windows 8.1, Windows RT 8.1
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 20H2

Discovery Timeline

2022-02-09 - CVE-2022-22718 published to NVD alongside Microsoft's February 2022 security update
2022-02-09 - Microsoft releases security patch via MSRC
2025-10-30 - Last updated in NVD database

Technical Details for CVE-2022-22718

Vulnerability Analysis

CVE-2022-22718 is an elevation of privilege flaw in the Windows Print Spooler component. The Print Spooler service runs as SYSTEM and manages print jobs, driver installation, and printer configuration. Improper handling within the service allows a low-privileged local user to escalate to SYSTEM.

Microsoft classified the issue as an elevation of privilege rather than remote code execution. The attacker must have valid local credentials and the ability to execute code on the target host. Once executed, the exploit subverts the Print Spooler's trust boundaries to perform actions in the SYSTEM security context.

CISA's inclusion of this CVE in the KEV catalog confirms that threat actors have weaponized the flaw against production systems. The vulnerability sits in the same component family as PrintNightmare (CVE-2021-34527) and related spooler issues that have been routinely abused for post-compromise privilege escalation.

Root Cause

Microsoft has not published detailed root cause information beyond classifying the issue under the Print Spooler service. The NVD entry lists the weakness as NVD-CWE-noinfo. The defect resides in privileged operations performed by spoolsv.exe that fail to adequately validate caller context or input before acting on behalf of SYSTEM.

Attack Vector

Exploitation requires local access and low-level authentication (PR:L). An attacker who has obtained an initial foothold, for example through phishing or a separate vulnerability, interacts with the Print Spooler service to trigger the privileged operation. No user interaction is required. Successful exploitation yields full confidentiality, integrity, and availability impact on the compromised host.

No public proof-of-concept code is listed in the NVD references. Defenders should treat the vulnerability as actively exploited based on the CISA KEV designation. Technical details are available in the Microsoft Security Update Guide and the CISA Known Exploited Vulnerabilities Catalog.

Detection Methods for CVE-2022-22718

Indicators of Compromise

Unexpected child processes spawned by spoolsv.exe, particularly cmd.exe, powershell.exe, or rundll32.exe running as SYSTEM
New or modified DLLs under C:\Windows\System32\spool\drivers\ written by non-administrative users
Print Spooler service crashes or restarts followed by privilege escalation events on the same host
Creation of new local administrator accounts or scheduled tasks immediately after Print Spooler activity

Detection Strategies

Monitor process creation events (Sysmon Event ID 1, Windows Event ID 4688) where spoolsv.exe is the parent of an interactive shell or scripting host
Audit file write events to spool\drivers\ and PRINTERS directories by processes other than spoolsv.exe and trusted installers
Correlate Print Spooler service state changes with subsequent Event ID 4672 (special privileges assigned) for unexpected accounts
Hunt for loaded modules in spoolsv.exe that originate from user-writable paths

Monitoring Recommendations

Enable command-line auditing and Sysmon across endpoints and servers to capture Print Spooler child processes
Forward Windows security and operational logs to a centralized SIEM for cross-host correlation
Track Print Spooler service status on systems where the service should be disabled, such as domain controllers and non-print servers

How to Mitigate CVE-2022-22718

Immediate Actions Required

Apply the February 2022 Microsoft security update for every affected Windows client and server build listed in the MSRC advisory
Prioritize patching on multi-user systems, domain controllers, and servers that are reachable by standard users
Disable the Print Spooler service on hosts that do not require print functionality, especially domain controllers
Restrict local logon rights to reduce the pool of users able to trigger local privilege escalation

Patch Information

Microsoft released cumulative updates on February 9, 2022 that remediate CVE-2022-22718 across all supported Windows versions. The patch is delivered through Windows Update, WSUS, and the Microsoft Update Catalog. Refer to the Microsoft Security Update Guide for the specific KB articles that map to each operating system build.

Workarounds

Stop and disable the Print Spooler service with Stop-Service -Name Spooler -Force and Set-Service -Name Spooler -StartupType Disabled on hosts that do not print
Apply Group Policy setting Computer Configuration > Administrative Templates > Printers > Allow Print Spooler to accept client connections set to Disabled to limit attack surface
Restrict driver installation to administrators using the RestrictDriverInstallationToAdministrators registry value

bash

# Disable Print Spooler on hosts that do not require printing
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Restrict printer driver installation to administrators
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" `
  -Name "RestrictDriverInstallationToAdministrators" -PropertyType DWORD -Value 1 -Force