---
id: "CVE-2026-112792"
page: "https://infrastack.ai/live/CVE-2026-112792"
kind: "vulnerability"
aliases: ["CVE-2026-112792"]
title: "Windows Print Spooler: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "print-spooler", "windows"]
not_affected_if: ["spooler-disabled"]
published_at: "2026-11-10T19:18:40+00:00"
first_seen_at: "2026-11-10T19:24:33+00:00"
updated_at: "2026-11-11T00:07:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112792", "first_seen_at": "2026-11-10T19:24:33+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112792", "first_seen_at": "2026-11-11T00:07:38+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-112792"]}]
exploit_sources: []
---

# Windows Print Spooler: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-112792 (this .md is for agents)

Microsoft's CNA record (via NVD) describes a use-after-free in Windows Print Spooler Components that lets an authorized local attacker elevate privileges. CVSS 7.0 (local, high complexity, low privileges). Affected builds and the patch are not yet confirmed from Microsoft's own page; no exploitation or public PoC is reported in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open the Microsoft Security Update Guide entry for CVE-2026-112792 (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112792), which lists affected Windows builds and the KB, and compare with your build from winver
- Run Get-Service Spooler: if the service is Disabled/Stopped on a machine, the spooler is not running there, but the vendor page has not been read to confirm that removes the exposure
- Affected versions and fixing update: unknown until the MSRC entry is read

## Timeline

- 2026-11-10T19:24:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112792
- 2026-11-11T00:07:38+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-112792 — MSRC and NVD pages for this id returned no content (not indexed/JS-only); affected builds and KB unconfirmed. Sibling Print Spooler CVEs (Sep/Oct 2026) were fixed in monthly cumulative updates, but that is not confirmed for this id. Nothing verified. Revisit when MSRC page loads: need affected builds, KB, exploitability.

## Documents

- [describes] NVD: CVE-2026-112792 https://nvd.nist.gov/vuln/detail/CVE-2026-112792

## From the sources

Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_