CVE-2026-70564: Windows Print Spooler Privilege Escalation

CVE-2026-70564 Overview

CVE-2026-70564 is a heap-based buffer overflow [CWE-122] in Windows Print Spooler Components. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft classifies the issue as an elevation of privilege vulnerability requiring low privileges and no user interaction.

Successful exploitation yields high impact to confidentiality, integrity, and availability of the target host. The vulnerability affects the Print Spooler subsystem, a long-standing target for local privilege escalation research on Windows.

Critical Impact
A local, authenticated attacker can corrupt heap memory in the Print Spooler service to gain SYSTEM-level privileges on the affected Windows host.

Affected Products

Windows Print Spooler Components (per Microsoft advisory)
Specific Windows versions and builds: refer to the Microsoft Security Update for the authoritative product list

Discovery Timeline

2026-09-08 - CVE-2026-70564 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-70564

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Windows Print Spooler Components. Print Spooler runs as a privileged service, so memory corruption inside its process allows attackers to escalate from a standard user context to SYSTEM. The attack vector is local, meaning the attacker must already have authenticated access to the host.

Exploitation does not require user interaction, which makes the flaw usable in post-compromise workflows such as pivoting after phishing, malware execution, or misuse of a low-privileged service account. According to the current EPSS estimate, in-the-wild exploitation activity has not been observed, and no public proof-of-concept has been published at the time of writing.

Root Cause

The root cause is improper bounds checking on heap-allocated buffers within Print Spooler code paths, categorized as [CWE-122] Heap-based Buffer Overflow. When attacker-controlled input exceeds the expected buffer size, adjacent heap metadata or object pointers are overwritten. Microsoft has not published detailed root-cause information beyond the advisory.

Attack Vector

An attacker with valid local credentials interacts with the Print Spooler service through its exposed interfaces, such as printing APIs, RPC endpoints, or driver installation paths. Malformed input triggers the overflow inside the spooler process, which runs as SYSTEM. Reliable exploitation typically requires heap grooming to place a controllable object adjacent to the overflowed buffer.

See the Microsoft Security Update for vendor-supplied technical context. No verified public exploit code is available at this time.

Detection Methods for CVE-2026-70564

Indicators of Compromise

Unexpected crashes or restarts of the spoolsv.exe service, particularly with heap corruption exceptions in Windows Error Reporting.
New child processes spawned by spoolsv.exe running as SYSTEM, especially interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
Suspicious DLLs or printer driver files written to C:\Windows\System32\spool\drivers\ by non-administrative users.
Anomalous RPC calls to Print Spooler interfaces originating from low-privileged user sessions.

Detection Strategies

Enable Windows Defender Exploit Guard and monitor for exploit protection events targeting spoolsv.exe.
Correlate process-creation telemetry to flag any non-print binary launched by the Print Spooler service.
Hunt for Print Spooler service crashes in the System event log (Event IDs 7031, 7034) followed by privileged process creation.

Monitoring Recommendations

Forward Sysmon process, image-load, and file-creation events for spoolsv.exe to a centralized analytics platform.
Alert on writes to spooler driver directories by users outside the Print Operators or Administrators groups.
Track RPC activity to Print Spooler endpoints (\pipe\spoolss) from unexpected source accounts or hosts.

How to Mitigate CVE-2026-70564

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update to all affected Windows systems.
Inventory servers and workstations running the Print Spooler service and prioritize domain controllers and high-value hosts.
Restrict local logon and interactive session rights on sensitive systems to reduce the population of accounts that can trigger the flaw.

Patch Information

Microsoft has issued a security update for CVE-2026-70564. Consult the Microsoft Security Update for the KB article, affected builds, and installation guidance. Deploy the update through Windows Update, WSUS, Microsoft Intune, or Configuration Manager according to organizational patching policy.

Workarounds

Disable the Print Spooler service on systems that do not require printing, particularly domain controllers and servers.
Configure Group Policy Point and Print Restrictions to require administrator approval for driver installation and updates.
Limit which users can add printers and printer drivers through the Prevent users from installing printer drivers policy.

bash

# Disable Print Spooler on hosts that do not require printing
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify service state
Get-Service -Name Spooler