CVE-2026-85353: Windows Print Spooler Information Disclosure

CVE-2026-85353 Overview

CVE-2026-85353 is an out-of-bounds read vulnerability in Windows Print Spooler Components. An unauthorized remote attacker can exploit the flaw to disclose sensitive information over a network without authentication or user interaction. The weakness is classified under CWE-125, covering out-of-bounds read conditions.

Microsoft published advisory details through the Microsoft Security Update Guide. The vulnerability affects the Print Spooler service, a historically targeted component on Windows systems.

Critical Impact
Remote, unauthenticated attackers can read out-of-bounds memory from the Print Spooler service, exposing confidential data accessible on affected Windows systems.

Affected Products

Windows Print Spooler Components (specific build list published in the Microsoft Security Update Guide)
Microsoft Windows client editions serviced by the October 2026 update cycle
Microsoft Windows Server editions serviced by the October 2026 update cycle

Discovery Timeline

2026-10-13 - CVE-2026-85353 published to the National Vulnerability Database
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-85353

Vulnerability Analysis

The vulnerability resides in Windows Print Spooler Components, the service responsible for managing print jobs and spooled data. An out-of-bounds read condition allows a remote attacker to read memory outside the intended buffer boundaries. The disclosed data may include process memory contents that aid further attack chains.

Exploitation requires no privileges and no user interaction, making the attack surface accessible to any network-adjacent attacker who can reach the Spooler service. The scope is limited to confidentiality impact. Integrity and availability of the target system are not directly affected by this flaw.

Print Spooler has a long history of memory-safety issues. This defect follows that pattern, originating from insufficient bounds checking when parsing network-received print-related structures.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in Print Spooler parsing logic. The service reads beyond the allocated buffer when processing attacker-controlled input, returning adjacent memory contents to the caller. Microsoft has not published the exact function or structure at fault.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to an exposed Print Spooler endpoint and receives a response containing leaked memory. No authentication is required, and the exploit does not require user interaction on the target host. Verified public proof-of-concept code is not available at the time of publication, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-85353

Indicators of Compromise

Unexpected inbound connections to TCP ports used by the Print Spooler service, including SMB (445) and RPC endpoints associated with spoolsv.exe.
Anomalous RPC calls targeting Print Spooler interfaces from untrusted network segments.
spoolsv.exe process returning unusually large or malformed responses to remote clients.

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-PrintService/Operational for malformed or unexpected print job submissions.
Deploy network intrusion detection signatures for crafted MS-RPRN and MS-PAR traffic targeting Spooler RPC interfaces.
Correlate Spooler process telemetry with network flow data to identify remote clients issuing abnormal request patterns.

Monitoring Recommendations

Alert on any external or non-print-server host initiating connections to Spooler RPC endpoints.
Track memory and handle usage of spoolsv.exe for anomalies that may indicate repeated exploitation attempts.
Baseline normal print traffic volume per host and flag deviations above the baseline.

How to Mitigate CVE-2026-85353

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-85353 on all affected Windows systems.
Inventory all systems running the Print Spooler service, including servers that do not host printers.
Restrict inbound access to Spooler RPC and SMB ports from untrusted networks using host and perimeter firewalls.

Patch Information

Microsoft released the patch in the October 2026 security update cycle. The authoritative patch metadata, affected build numbers, and KB identifiers are listed in the Microsoft Security Update Guide. Administrators should deploy updates through Windows Update, WSUS, or configuration management tooling and verify installation using patch compliance reports.

Workarounds

Disable the Print Spooler service (Stop-Service -Name Spooler; Set-Service -Name Spooler -StartupType Disabled) on systems that do not require printing, especially domain controllers and member servers.
Block inbound Spooler-related RPC traffic at network boundaries where printing from untrusted networks is not required.
Apply Group Policy restrictions on inbound remote printing where disabling the service is not feasible.

bash

# Configuration example: disable Print Spooler on systems that do not need it
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify the service state
Get-Service -Name Spooler | Select-Object Name, Status, StartType