CVE-2026-57085: Windows 10 Information Disclosure Flaw

CVE-2026-57085 Overview

CVE-2026-57085 is an out-of-bounds read vulnerability [CWE-125] in the Windows Print Spooler Components. An authenticated local attacker can trigger the flaw to read memory outside allocated bounds and disclose information from the affected system. The issue affects a broad range of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Microsoft published the advisory on 2026-07-14 and last updated the record on 2026-07-17. Exploitation requires local access and low privileges, and no user interaction is needed. There are no public proof-of-concept exploits, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated local user can read adjacent memory in the Print Spooler process to disclose sensitive information such as pointers, handles, or buffered print data.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and arm64
Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and arm64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-57085 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-57085

Vulnerability Analysis

The vulnerability resides in the Windows Print Spooler Components, the service responsible for managing print jobs, printer drivers, and spool files. An out-of-bounds read occurs when the component processes a request and reads beyond the boundaries of a buffer it owns. The extra bytes returned can include process memory such as pointers, handles, or fragments of previously queued print data. An attacker who is already authenticated on the host can call the vulnerable interface with crafted input to leak these bytes. The disclosed data can support further attack stages, including bypassing address space layout randomization (ASLR) or recovering sensitive content sent to printers. Print Spooler runs with elevated privileges, so leaked memory may cross trust boundaries between the local user and the service context.

Root Cause

The root cause is missing or incorrect validation of a length or index value used when the Print Spooler reads from an internal buffer. Under CWE-125, the component computes a read range that extends past the end of the allocated region. Because the check is absent or performed after the read, adjacent memory is returned to the caller.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An authorized user submits a crafted request to a Print Spooler interface, such as a spooler RPC method or a local print API. The malformed request drives the component into the out-of-bounds read path, and the returned data exposes memory contents to the attacker.

No verified proof-of-concept code is available. See the Microsoft Security Update CVE-2026-57085 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-57085

Indicators of Compromise

Unexpected crashes or access violation events tied to spoolsv.exe in the Windows Application or System event logs.
Local processes with low privileges issuing an unusual volume of Print Spooler RPC calls or winspool.drv API requests.
Anomalous handle counts or memory growth in spoolsv.exe correlated with non-administrative user sessions.

Detection Strategies

Baseline normal Print Spooler activity per host and alert on deviations from standard printing workflows.
Monitor process telemetry for unsigned or user-writable modules loaded into spoolsv.exe.
Correlate authenticated local logon events with Print Spooler interactions initiated by non-print applications.

Monitoring Recommendations

Enable auditing on the Print Spooler service and forward spoolsv.exe process events to a centralized log platform.
Track patch state across all Windows 10, Windows 11, and Windows Server hosts to confirm the July 2026 update is applied.
Review Print Spooler operational logs for repeated failed operations from the same local user account.

How to Mitigate CVE-2026-57085

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft advisory for CVE-2026-57085 to all affected Windows versions.
Prioritize patching of multi-user systems, jump hosts, terminal servers, and print servers where local accounts are most common.
Audit which endpoints and servers actually require the Print Spooler service and disable it on systems that do not print.

Patch Information

Microsoft has released fixes through the Windows Update channel for all listed products, including Windows 10 1607, 1809, 21H2, 22H2, Windows 11 24H2, 25H2, 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Consult the Microsoft Security Update CVE-2026-57085 guide for the specific KB article that corresponds to each build.

Workarounds

Disable the Print Spooler service on servers and endpoints that do not need to print or accept print jobs.
Restrict local logon rights and interactive access on systems where the Print Spooler must remain enabled.
Limit which users can submit print jobs and enforce least privilege on local accounts to reduce the attacker pool.

bash

# Disable the Print Spooler service on systems that do not print
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled