CVE-2026-85877: Windows 11 24H2 Buffer Overflow Vulnerability

CVE-2026-85877 Overview

CVE-2026-85877 is a heap-based buffer overflow [CWE-122] in the Windows Print Spooler Components. An unauthorized attacker can exploit the flaw over a network to execute arbitrary code on affected systems. The vulnerability affects Microsoft Windows 11 24H2 on x64 platforms. Exploitation requires user interaction, but no authentication or elevated privileges are needed on the target system. Successful exploitation results in full compromise of confidentiality, integrity, and availability.

Critical Impact
Remote attackers can achieve code execution in the Print Spooler service context on unpatched Windows 11 24H2 hosts, enabling lateral movement and persistence across enterprise networks.

Affected Products

Microsoft Windows 11 24H2 (x64)
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
Windows Print Spooler Components on the above platform

Discovery Timeline

2026-09-08 - CVE-2026-85877 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database
2026-09-10 - EPSS score recorded at 0.432% (percentile 36.458)

Technical Details for CVE-2026-85877

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the Windows Print Spooler Components. Print Spooler processes print job data, printer driver installations, and RPC-exposed spooler operations. When the vulnerable component parses attacker-controlled input, it writes past the bounds of a heap-allocated buffer. This memory corruption can be shaped into a controlled write, enabling arbitrary code execution in the context of the Print Spooler service. The service historically runs with elevated privileges, which amplifies post-exploitation impact on the host.

Root Cause

The root cause is improper validation of the size of input written into a heap-allocated buffer inside a Print Spooler component. The condition maps to CWE-122 (Heap-based Buffer Overflow). An attacker can craft a malformed print-related structure whose payload length exceeds the destination allocation, corrupting adjacent heap metadata or object pointers.

Attack Vector

The attack originates over the network and does not require prior authentication. Exploitation requires user interaction, meaning an authorized user on the target system must perform an action such as opening a document, initiating a print job, or interacting with a malicious printer endpoint. After exploitation, the attacker executes code within the Print Spooler service and can pivot to further internal targets.

No public proof-of-concept exploit is currently listed for CVE-2026-85877, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Technical mechanics are described in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-85877

Indicators of Compromise

Unexpected crashes, restarts, or memory faults involving the spoolsv.exe process on Windows 11 24H2 hosts.
Anomalous child processes spawned by spoolsv.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Inbound network connections to Print Spooler RPC endpoints from untrusted or external sources.
Creation of unsigned DLLs or driver files under C:\Windows\System32\spool\drivers\ outside of standard patch windows.

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-PrintService/Admin and Microsoft-Windows-PrintService/Operational for abnormal driver installations and spooler errors.
Correlate spoolsv.exe process creation events (Sysmon Event ID 1) with unusual command lines or parent-child relationships.
Alert on WerFault crash reports naming spoolsv.exe or Print Spooler modules as the faulting image.
Hunt for RPC calls to Print Spooler interfaces from non-domain or unmanaged endpoints.

Monitoring Recommendations

Enable command-line auditing and Sysmon on all Windows 11 24H2 endpoints, prioritizing print servers.
Ingest print service telemetry into a centralized SIEM or data lake for cross-host correlation.
Track outbound connections from spoolsv.exe, which should rarely initiate external network activity.
Baseline expected printer driver installations to surface unauthorized additions promptly.

How to Mitigate CVE-2026-85877

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all Windows 11 24H2 systems.
Inventory endpoints and print servers running Windows 11 24H2 to confirm patch coverage.
Restrict inbound access to Print Spooler RPC endpoints from untrusted network segments.
Educate users to avoid opening untrusted print jobs or connecting to unknown printer shares.

Patch Information

Microsoft has published the fix through the Microsoft Security Update Guide entry for CVE-2026-85877. Administrators should deploy the corresponding cumulative update for Windows 11 24H2 via Windows Update, WSUS, Microsoft Intune, or Configuration Manager. Verify installation by checking the OS build number against the Microsoft-listed patched build after deployment.

Workarounds

Disable the Print Spooler service (Stop-Service -Name Spooler and Set-Service -Name Spooler -StartupType Disabled) on systems that do not require printing.
Block inbound SMB and RPC traffic to Print Spooler on endpoints that are not print servers.
Restrict Point and Print behavior via Group Policy to require administrative approval for driver installation.
Segment print servers from general user networks and require authenticated access.

bash

# Configuration example: disable Print Spooler on non-print hosts (PowerShell, run as Administrator)
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Get-Service -Name Spooler | Select-Object Name, Status, StartType