{"id":"CVE-2026-112765","kind":"vulnerability","aliases":["CVE-2026-112765"],"related":[],"title":"Windows Print Spooler: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Print Spooler components lets an attacker who already has an account on the machine raise their privileges. The flaw is local, so the attacker must be able to run code or log on to the affected system first.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Print Spooler Components","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","print-spooler","windows"],"not_affected_if":["spooler-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:39+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","triaged_at":"2026-11-10T19:53:43+00:00","updated_at":"2026-11-10T19:53:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:53:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Print Spooler components lets an attacker who already has an account on the machine raise their privileges. The flaw is local, so the attacker must be able to run code or log on to the affected system first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the vendor advisory and affected Windows build list at https://nvd.nist.gov/vuln/detail/CVE-2026-112765 and confirm the patch and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"Windows Print Spooler Components","needs_analyst":true,"not_affected_if":["spooler-disabled"],"who_is_affected":"Windows machines with the Print Spooler service present and running are the systems to look at. The sources do not state which Windows versions or configurations are affected, and the flaw needs an authorized local account, so machines without the spooler running or without untrusted local users are lower risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4497,"output_tokens":502,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and affected Windows build list at https://nvd.nist.gov/vuln/detail/CVE-2026-112765 and confirm the patch and any mitigation.","search":"'-112765':15A,18A '-2026':14A,17A 'abl':63B 'account':47B 'affect':72B 'allow':85C 'alreadi':44B 'attack':42B,60B,88C 'author':87C 'base':31B,77C 'buffer':32B,78C 'code':66B 'compon':39B,84C 'components':22A 'cve':13A,16A 'elev':90C 'first':74B 'flaw':55B 'gain':10A 'heap':4A,30B,76C 'heap-bas':29B,75C 'higher':11A 'infrastructur':23B 'let':6A,40B 'local':8A,57B,92C 'log':68B 'machin':50B 'must':61B 'overflow':5A,33B,79C 'print':2A,20A,25B,37B,82C 'print-spool':24B 'privileg':12A,53B,91C 'rais':51B 'run':65B 'spooler':3A,21A,26B,38B,83C 'system':73B 'user':9A 'window':1A,27B,36B,81C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Print Spooler service present and running are the systems to look at. The sources do not state which Windows versions or configurations are affected, and the flaw needs an authorized local account, so machines without the spooler running or without untrusted local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["printspoolercomponents","windowsprintspoolercomponents"],"ptokens":["components","print","spooler","windows"],"labels":["high","infrastructure","printspooler","vendor","windows"],"campaign_type":null,"search_a":"'-112765':15A,18A '-2026':14A,17A 'components':22A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'print':2A,20A 'privileg':12A 'spooler':3A,21A 'user':9A 'window':1A 'windows':19A","search_b":"'abl':63B 'account':47B 'affect':72B 'alreadi':44B 'attack':42B,60B 'base':31B 'buffer':32B 'code':66B 'compon':39B 'first':74B 'flaw':55B 'heap':30B 'heap-bas':29B 'infrastructur':23B 'let':40B 'local':57B 'log':68B 'machin':50B 'must':61B 'overflow':33B 'print':25B,37B 'print-spool':24B 'privileg':53B 'rais':51B 'run':65B 'spooler':26B,38B 'system':73B 'window':27B,36B","search_c":"'allow':85C 'attack':88C 'author':87C 'base':77C 'buffer':78C 'compon':84C 'elev':90C 'heap':76C 'heap-bas':75C 'local':92C 'overflow':79C 'print':82C 'privileg':91C 'spooler':83C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112765","severity":null,"published_at":"2026-11-10T19:18:39+00:00","modified_at":"2026-11-10T19:18:39+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","fetched_at":"2026-11-10T19:24:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}