{"id":"CVE-2026-112811","kind":"vulnerability","aliases":["CVE-2026-112811"],"related":[],"title":"Windows Print Spooler: local user can gain higher privileges via overflow","description":"Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A stack-based buffer overflow in the Windows Print Spooler components lets an authorized local user elevate their privileges. An attacker who already has a foothold on the machine can gain system-level control.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 / Server 2019 (1809)","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local","print-spooler","privilege-escalation","title-review","windows"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [System.Environment]::OSVersion / 'cmd /c ver' and compare the full build (e.g. 10.0.26100.xxxx) with the fixed build for your version: Win10 1607/Server 2016 14393.9688; 1809/Server 2019 17763.9487; Win10 21H2/22H2 19044/19045.7846; Win11 23H2 22631.7711; 24H2 26100.9974; 25H2 26200.9974; 26H1 28000.3501; 26H2 26300.9974; Server 2022 20348.5870; Server 2025 26100.33822. Anything lower is vulnerable.","fix":"Install the November 2026 Windows cumulative update that takes the OS build to at least the fixed build for your version (e.g. Win 11 24H2 10.0.26100.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB numbers not confirmed; check MSRC for CVE-2026-112811.","status":"open","published_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","triaged_at":"2026-11-10T19:41:05+00:00","updated_at":"2026-11-11T00:04:03+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:41:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: local user can gain higher privileges via overflow","impact":"high","summary":"A stack-based buffer overflow in the Windows Print Spooler components lets an authorized local user elevate their privileges. An attacker who already has a foothold on the machine can gain system-level control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft fixed-build list at the NVD entry and Microsoft's security update guide.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Print Spooler","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Print Spooler components present, where a user already has a local account. The sources do not name affected Windows builds or whether the Print Spooler service must be running. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4497,"output_tokens":430,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft fixed-build list at the NVD entry and Microsoft's security update guide.","search":"'-112811':14A,17A '-2026':13A,16A '10':19A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':28A '2016':23A '2019':27A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'allow':114C 'alreadi':91B 'attack':89B,117C 'author':82B,116C 'base':71B,106C 'buffer':72B,107C 'compon':79B,113C 'control':103B 'cve':12A,15A 'elev':85B,119C 'escal':63B 'foothold':94B 'gain':7A,99B 'higher':8A 'infrastructur':56B 'let':80B 'level':102B 'local':4A,57B,83B,121C 'machin':97B 'overflow':11A,73B,108C 'print':2A,59B,77B,111C 'print-spool':58B 'privileg':9A,62B,87B,120C 'privilege-escal':61B 'review':66B 'server':22A,26A,51A,54A 'spooler':3A,60B,78B,112C 'stack':70B,105C 'stack-bas':69B,104C 'system':101B 'system-level':100B 'titl':65B 'title-review':64B 'user':5A,84B 'version':20A 'via':10A 'window':1A,67B,76B,110C 'windows':18A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 to 26H2) and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) below the fixed builds. An attacker needs a low-privilege local account and can then gain SYSTEM. Mostly matters on shared machines, RDP/terminal servers and workstations where a foothold is plausible; single-user machines with no untrusted code are lower risk. Whether the spooler service must be running is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","10server20191809","10version1607server2016","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows1021h2","windows1022h2","windows10server20191809","windows10version1607server2016","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","version","windows"],"labels":["high","infrastructure","local","printspooler","privilegeescalation","titlereview","vendor","windows"],"campaign_type":null,"search_a":"'-112811':14A,17A '-2026':13A,16A '10':19A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':28A '2016':23A '2019':27A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'cve':12A,15A 'gain':7A 'higher':8A 'local':4A 'overflow':11A 'print':2A 'privileg':9A 'server':22A,26A,51A,54A 'spooler':3A 'user':5A 'version':20A 'via':10A 'window':1A 'windows':18A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","search_b":"'alreadi':91B 'attack':89B 'author':82B 'base':71B 'buffer':72B 'compon':79B 'control':103B 'elev':85B 'escal':63B 'foothold':94B 'gain':99B 'infrastructur':56B 'let':80B 'level':102B 'local':57B,83B 'machin':97B 'overflow':73B 'print':59B,77B 'print-spool':58B 'privileg':62B,87B 'privilege-escal':61B 'review':66B 'spooler':60B,78B 'stack':70B 'stack-bas':69B 'system':101B 'system-level':100B 'titl':65B 'title-review':64B 'user':84B 'window':67B,76B","search_c":"'allow':114C 'attack':117C 'author':116C 'base':106C 'buffer':107C 'compon':113C 'elev':119C 'local':121C 'overflow':108C 'print':111C 'privileg':120C 'spooler':112C 'stack':105C 'stack-bas':104C 'window':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112811","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112811","severity":null,"published_at":"2026-11-10T19:18:45+00:00","modified_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","fetched_at":"2026-11-10T19:24:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112811:3278","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112811","severity":null,"published_at":"2026-11-11T00:04:03+00:00","modified_at":"2026-11-11T00:04:03+00:00","first_seen_at":"2026-11-11T00:04:03+00:00","fetched_at":"2026-11-11T00:04:03+00:00","note":"Read NVD JSON (Microsoft CNA data): affected builds and fixed-build thresholds. MSRC page returned no text, so nothing marked verified; KB numbers unknown. CISA SSVC: exploitation none, not automatable. Not exploited, no PoC found.","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112811"]}],"documents":[{"id":120515,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112811","title":"NVD record CVE-2026-112811 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}