CVE-2022-30138: Windows Print Spooler Privilege Escalation

CVE-2022-30138 Overview

CVE-2022-30138 is an elevation of privilege vulnerability in the Windows Print Spooler service. The flaw affects a broad set of Windows desktop and server releases, including Windows 7 through Windows 11 and Windows Server 2008 through Windows Server 2022. An authenticated local attacker can abuse the Print Spooler to gain higher privileges on the target host.

Critical Impact
Successful exploitation allows a low-privileged local user to escalate to SYSTEM-level privileges on a vulnerable Windows host, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (including 1607, 1809, 1909, 20H2, 21H1, 21H2) and Windows 11 (x64, ARM64)
Microsoft Windows 7 SP1, Windows 8.1, and Windows RT 8.1
Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, and 2022

Discovery Timeline

2022-05-18 - CVE-2022-30138 published to NVD
2025-01-02 - Last updated in NVD database

Technical Details for CVE-2022-30138

Vulnerability Analysis

The vulnerability resides in the Windows Print Spooler service (spoolsv.exe), a component that manages print jobs and printer driver installation. Print Spooler runs as SYSTEM and exposes interfaces accessible to authenticated local users. A flaw in how the service handles privileged operations enables an attacker to elevate privileges from a standard user context to SYSTEM.

The issue is local in nature and requires the attacker to already have valid credentials or code execution on the host. No user interaction is required to trigger the flaw once the attacker has an interactive or programmatic session. According to the EPSS data set, the probability score for in-the-wild exploitation is 1.514%, placing the CVE in the 81st percentile.

Microsoft classifies the issue under [CWE-noinfo] in NVD because the specific weakness category was not disclosed in the public advisory.

Root Cause

The root cause lies in improper privilege handling within Print Spooler operations exposed to local callers. The service performs actions in a SYSTEM context on behalf of lower-privileged requesters without adequate validation. This pattern is a recurring theme across Print Spooler vulnerabilities, which have repeatedly been used as local privilege escalation vectors on Windows.

Attack Vector

An attacker with local access and low privileges invokes Print Spooler functionality to perform an operation that the service executes with elevated rights. The attacker leverages this differential in trust to write files, load modules, or modify state in locations otherwise inaccessible to the user. The result is code execution as SYSTEM.

No public proof-of-concept exploit is listed for this CVE in the enriched data, and it does not appear in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Advisory CVE-2022-30138 for vendor-provided technical context.

Detection Methods for CVE-2022-30138

Indicators of Compromise

Unexpected child processes spawned by spoolsv.exe, particularly cmd.exe, powershell.exe, or rundll32.exe running as SYSTEM
New or modified DLLs in printer driver directories such as C:\Windows\System32\spool\drivers\ and its subfolders
Print Spooler service crashes or restarts that correlate with local user activity

Detection Strategies

Monitor Windows Event Log channel Microsoft-Windows-PrintService/Operational for anomalous driver installation events triggered by non-administrative users
Alert on file write operations into C:\Windows\System32\spool\drivers\ originating from non-system accounts
Hunt for process lineage where spoolsv.exe is the parent of interactive shells or scripting hosts

Monitoring Recommendations

Enable command-line auditing (Event ID 4688) and Sysmon process creation logging to capture Print Spooler child processes
Forward Print Spooler operational and security event logs to a centralized SIEM for correlation
Track service start, stop, and restart events for Spooler on servers that do not require printing

How to Mitigate CVE-2022-30138

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2022-30138 Patch advisory across all affected Windows versions
Inventory hosts running the Print Spooler service and prioritize servers and domain controllers for patching
Audit local accounts and remove unnecessary interactive logon rights to reduce the local attacker surface

Patch Information

Microsoft addressed CVE-2022-30138 in the May 2022 security update cycle. Patches are available for all supported Windows desktop and server SKUs listed in the affected products section. Consult the Microsoft Security Advisory CVE-2022-30138 for KB article numbers specific to each Windows build.

Workarounds

Disable the Print Spooler service on systems that do not require printing, including domain controllers and most server roles, using Stop-Service -Name Spooler -Force and Set-Service -Name Spooler -StartupType Disabled
Restrict driver installation to administrators via the Group Policy setting Computer Configuration\Administrative Templates\Printers\Point and Print Restrictions
Limit which users can connect to and install printers on critical hosts through Group Policy and local security policy hardening

bash

# Configuration example: disable Print Spooler on hosts that do not require printing
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Get-Service -Name Spooler | Select-Object Status, StartType