{"id":"CVE-2026-112792","kind":"vulnerability","aliases":["CVE-2026-112792"],"related":[],"title":"Windows Print Spooler: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Print Spooler components lets an attacker who already has a local account raise their privileges. The sources give no further detail on how the flaw is triggered.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","print-spooler","windows"],"not_affected_if":["spooler-disabled"],"how_to_check":"- Check the Windows build with `winver` and compare it to the Microsoft security update that lists CVE-2026-112792\n- Check whether the Print Spooler service is running with `Get-Service Spooler`\n- Check the vendor advisory for the affected Windows versions, which the sources do not list","fix":null,"status":"open","published_at":"2026-11-10T19:18:40+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:53:40+00:00","updated_at":"2026-11-10T19:53:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:53:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Print Spooler components lets an attacker who already has a local account raise their privileges. The sources give no further detail on how the flaw is triggered.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated system privileges on the machine","analyst_note":"Find the Microsoft Security Response Center entry for CVE-2026-112792 to confirm affected Windows builds and the patch.","how_to_check":"- Check the Windows build with `winver` and compare it to the Microsoft security update that lists CVE-2026-112792\n- Check whether the Print Spooler service is running with `Get-Service Spooler`\n- Check the vendor advisory for the affected Windows versions, which the sources do not list","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["spooler-disabled"],"who_is_affected":"Windows machines with the Print Spooler components present, where a user already has a local account. The sources do not state which Windows versions or configurations are affected, so unknown. Machines where the spooler is disabled are likely not exposed, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4484,"output_tokens":528,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center entry for CVE-2026-112792 to confirm affected Windows builds and the patch.","search":"'-112792':17A,20A '-2026':16A,19A 'account':45B 'allow':69C 'alreadi':41B 'attack':39B,72C 'author':71C 'bug':31B 'compon':36B,68C 'cve':15A,18A 'detail':54B 'elev':74C 'flaw':58B 'free':7A,30B,63C 'gain':12A 'give':51B 'higher':13A 'infrastructur':21B 'let':8A,37B 'local':10A,44B,76C 'print':2A,23B,34B,66C 'print-spool':22B 'privileg':14A,48B,75C 'rais':46B 'sourc':50B 'spooler':3A,24B,35B,67C 'trigger':60B 'use':5A,28B,61C 'use-after-fre':4A,27B 'user':11A 'window':1A,25B,33B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Print Spooler components present, where a user already has a local account. The sources do not state which Windows versions or configurations are affected, so unknown. Machines where the spooler is disabled are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","printspooler","windows"],"campaign_type":null,"search_a":"'-112792':17A,20A '-2026':16A,19A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'print':2A 'privileg':14A 'spooler':3A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':45B 'alreadi':41B 'attack':39B 'bug':31B 'compon':36B 'detail':54B 'flaw':58B 'free':30B 'give':51B 'infrastructur':21B 'let':37B 'local':44B 'print':23B,34B 'print-spool':22B 'privileg':48B 'rais':46B 'sourc':50B 'spooler':24B,35B 'trigger':60B 'use':28B 'use-after-fre':27B 'window':25B,33B","search_c":"'allow':69C 'attack':72C 'author':71C 'compon':68C 'elev':74C 'free':63C 'local':76C 'print':66C 'privileg':75C 'spooler':67C 'use':61C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112792","severity":null,"published_at":"2026-11-10T19:18:40+00:00","modified_at":"2026-11-10T19:18:40+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}