{"id":"CVE-2026-112797","kind":"vulnerability","aliases":["CVE-2026-112797"],"related":[],"title":"Windows Print Spooler: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Print Spooler components lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher system rights.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Print Spooler","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","print-spooler","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update that lists CVE-2026-112797.\n- Check whether the Print Spooler service is running with `Get-Service Spooler`.","fix":null,"status":"open","published_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:53:38+00:00","updated_at":"2026-11-10T19:53:38+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Print Spooler components lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher system rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find Microsoft's advisory for CVE-2026-112797 to confirm affected Windows builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update that lists CVE-2026-112797.\n- Check whether the Print Spooler service is running with `Get-Service Spooler`.","plain_action":"","product_name":"Windows Print Spooler","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine where an attacker already has a local, authorized account can be affected, since the bug is triggered on the machine itself. The sources do not name affected Windows builds, so check Microsoft's advisory for the exact range. Systems where users are not allowed local logins are less exposed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4484,"output_tokens":534,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-112797 to confirm affected Windows builds and the fixed update.","search":"'-112797':17A,20A '-2026':16A,19A 'account':56B 'allow':70C 'alreadi':52B 'attack':50B,73C 'author':43B,72C 'bug':34B 'compon':40B,69C 'cve':15A,18A 'elev':46B,75C 'free':7A,33B,64C 'gain':12A,58B 'higher':13A,59B 'infrastructur':24B 'let':8A,41B 'local':10A,44B,55B,77C 'print':2A,22A,26B,38B,67C 'print-spool':25B 'privileg':14A,48B,76C 'right':61B 'spooler':3A,23A,27B,39B,68C 'system':60B 'use':5A,31B,62C 'use-after-fre':4A,30B 'user':11A,45B 'window':1A,28B,37B,66C 'windows':21A","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an attacker already has a local, authorized account can be affected, since the bug is triggered on the machine itself. The sources do not name affected Windows builds, so check Microsoft's advisory for the exact range. Systems where users are not allowed local logins are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["printspooler","windowsprintspooler"],"ptokens":["print","spooler","windows"],"labels":["high","infrastructure","printspooler","vendor","windows"],"campaign_type":null,"search_a":"'-112797':17A,20A '-2026':16A,19A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'print':2A,22A 'privileg':14A 'spooler':3A,23A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':21A","search_b":"'account':56B 'alreadi':52B 'attack':50B 'author':43B 'bug':34B 'compon':40B 'elev':46B 'free':33B 'gain':58B 'higher':59B 'infrastructur':24B 'let':41B 'local':44B,55B 'print':26B,38B 'print-spool':25B 'privileg':48B 'right':61B 'spooler':27B,39B 'system':60B 'use':31B 'use-after-fre':30B 'user':45B 'window':28B,37B","search_c":"'allow':70C 'attack':73C 'author':72C 'compon':69C 'elev':75C 'free':64C 'local':77C 'print':67C 'privileg':76C 'spooler':68C 'use':62C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112797","severity":null,"published_at":"2026-11-10T19:18:41+00:00","modified_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}