{"id":"CVE-2026-112981","kind":"vulnerability","aliases":["CVE-2026-112981"],"related":[],"title":"Windows Print Spooler: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Print Spooler components lets an authorized user raise their privileges on the same machine. The attacker needs a local account first and cannot use this flaw from the network alone.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","multi-user-hosts","print-spooler","windows"],"not_affected_if":["print-spooler-disabled","single-user-machines"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-112981 (unknown which build is fixed; the sources do not say)\n- Check whether the Print Spooler service is running with `Get-Service Spooler` in PowerShell (unknown whether this affects exposure; the sources do not say)","fix":null,"status":"open","published_at":"2026-11-10T19:18:50+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","triaged_at":"2026-11-10T19:41:03+00:00","updated_at":"2026-11-10T19:41:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:41:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Print Spooler components lets an authorized user raise their privileges on the same machine. The attacker needs a local account first and cannot use this flaw from the network alone.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler","multi-user-hosts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains higher system privileges on the machine.","analyst_note":"Find the Microsoft advisory for CVE-2026-112981 to get the fixed Windows builds and any configuration notes; the NVD entry alone gives neither.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-112981 (unknown which build is fixed; the sources do not say)\n- Check whether the Print Spooler service is running with `Get-Service Spooler` in PowerShell (unknown whether this affects exposure; the sources do not say)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machines","print-spooler-disabled"],"who_is_affected":"Any Windows machine with the Print Spooler components present is in scope, and the flaw only matters where people with ordinary local accounts share the machine. The sources do not state which Windows builds are vulnerable or which configurations change exposure, so the team should check the vendor advisory before deciding how urgent it is.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4497,"output_tokens":594,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-112981 to get the fixed Windows builds and any configuration notes; the NVD entry alone gives neither.","search":"'-112981':15A,18A '-2026':14A,17A 'account':56B 'allow':77C 'alon':66B 'attack':52B,80C 'author':42B,79C 'base':31B,69C 'buffer':32B,70C 'cannot':59B 'compon':39B,76C 'cve':13A,16A 'elev':82C 'first':57B 'flaw':62B 'gain':10A 'heap':4A,30B,68C 'heap-bas':29B,67C 'higher':11A 'host':23B 'infrastructur':19B 'let':6A,40B 'local':8A,55B,84C 'machin':50B 'multi':21B 'multi-user-host':20B 'need':53B 'network':65B 'overflow':5A,33B,71C 'print':2A,25B,37B,74C 'print-spool':24B 'privileg':12A,46B,83C 'rais':44B 'spooler':3A,26B,38B,75C 'use':60B 'user':9A,22B,43B 'window':1A,27B,36B,73C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the Print Spooler components present is in scope, and the flaw only matters where people with ordinary local accounts share the machine. The sources do not state which Windows builds are vulnerable or which configurations change exposure, so the team should check the vendor advisory before deciding how urgent it is.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","multiuserhosts","printspooler","windows"],"campaign_type":null,"search_a":"'-112981':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'print':2A 'privileg':12A 'spooler':3A 'user':9A 'window':1A","search_b":"'account':56B 'alon':66B 'attack':52B 'author':42B 'base':31B 'buffer':32B 'cannot':59B 'compon':39B 'first':57B 'flaw':62B 'heap':30B 'heap-bas':29B 'host':23B 'infrastructur':19B 'let':40B 'local':55B 'machin':50B 'multi':21B 'multi-user-host':20B 'need':53B 'network':65B 'overflow':33B 'print':25B,37B 'print-spool':24B 'privileg':46B 'rais':44B 'spooler':26B,38B 'use':60B 'user':22B,43B 'window':27B,36B","search_c":"'allow':77C 'attack':80C 'author':79C 'base':69C 'buffer':70C 'compon':76C 'elev':82C 'heap':68C 'heap-bas':67C 'local':84C 'overflow':71C 'print':74C 'privileg':83C 'spooler':75C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112981","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112981","severity":null,"published_at":"2026-11-10T19:18:50+00:00","modified_at":"2026-11-10T19:18:50+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","fetched_at":"2026-11-10T19:24:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}