{"id":"CVE-2026-113752","kind":"vulnerability","aliases":["CVE-2026-113752"],"related":[],"title":"Windows Print Spooler: use-after-free lets a nearby attacker run code","description":"Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free bug in the Windows Print Spooler components lets an unauthorized attacker run code on an affected Windows machine. The attack works over an adjacent network, so the attacker must be on the same local network segment.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","print-spooler","self-hosted","windows"],"not_affected_if":["no-adjacent-network-access","spooler-disabled"],"how_to_check":"- Check whether the Print Spooler service is running on Windows hosts, for example with `Get-Service Spooler` in PowerShell.\n- Check the installed Windows build against Microsoft's security update guide entry for CVE-2026-113752 (unknown from these sources).","fix":null,"status":"open","published_at":"2026-11-10T19:18:53+00:00","first_seen_at":"2026-11-10T19:24:38+00:00","triaged_at":"2026-11-10T19:45:07+00:00","updated_at":"2026-11-10T19:45:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:45:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Print Spooler: use-after-free lets a nearby attacker run code","impact":"high","summary":"A use-after-free bug in the Windows Print Spooler components lets an unauthorized attacker run code on an affected Windows machine. The attack works over an adjacent network, so the attacker must be on the same local network segment.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine from the local network","analyst_note":"Confirm affected Windows builds, fixed versions and default Print Spooler state from the Microsoft security update guide entry for CVE-2026-113752.","how_to_check":"- Check whether the Print Spooler service is running on Windows hosts, for example with `Get-Service Spooler` in PowerShell.\n- Check the installed Windows build against Microsoft's security update guide entry for CVE-2026-113752 (unknown from these sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["spooler-disabled","no-adjacent-network-access"],"who_is_affected":"Windows systems with the Print Spooler service exposed to an adjacent network are the relevant targets. The sources do not state which Windows builds are affected or whether the service must be enabled by default. Systems without the Print Spooler service running, or isolated from the adjacent network, are less exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4492,"output_tokens":568,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds, fixed versions and default Print Spooler state from the Microsoft security update guide entry for CVE-2026-113752.","search":"'-113752':16A,19A '-2026':15A,18A 'adjac':56B,86C 'affect':48B 'allow':77C 'attack':11A,43B,52B,60B,80C 'bug':33B 'code':13A,45B,83C 'compon':39B,76C 'cve':14A,17A 'execut':82C 'free':7A,32B,71C 'host':26B 'infrastructur':20B 'let':8A,40B 'local':66B 'machin':50B 'must':61B 'nearbi':10A 'network':57B,67B,87C 'print':2A,22B,37B,74C 'print-spool':21B 'run':12A,44B 'segment':68B 'self':25B 'self-host':24B 'spooler':3A,23B,38B,75C 'unauthor':42B,79C 'use':5A,30B,69C 'use-after-fre':4A,29B 'window':1A,27B,36B,49B,73C 'work':53B","nicknames":[],"mitigations":[],"who_affected":"Windows systems with the Print Spooler service exposed to an adjacent network are the relevant targets. The sources do not state which Windows builds are affected or whether the service must be enabled by default. Systems without the Print Spooler service running, or isolated from the adjacent network, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","printspooler","selfhosted","windows"],"campaign_type":null,"search_a":"'-113752':16A,19A '-2026':15A,18A 'attack':11A 'code':13A 'cve':14A,17A 'free':7A 'let':8A 'nearbi':10A 'print':2A 'run':12A 'spooler':3A 'use':5A 'use-after-fre':4A 'window':1A","search_b":"'adjac':56B 'affect':48B 'attack':43B,52B,60B 'bug':33B 'code':45B 'compon':39B 'free':32B 'host':26B 'infrastructur':20B 'let':40B 'local':66B 'machin':50B 'must':61B 'network':57B,67B 'print':22B,37B 'print-spool':21B 'run':44B 'segment':68B 'self':25B 'self-host':24B 'spooler':23B,38B 'unauthor':42B 'use':30B 'use-after-fre':29B 'window':27B,36B,49B 'work':53B","search_c":"'adjac':86C 'allow':77C 'attack':80C 'code':83C 'compon':76C 'execut':82C 'free':71C 'network':87C 'print':74C 'spooler':75C 'unauthor':79C 'use':69C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113752","severity":null,"published_at":"2026-11-10T19:18:53+00:00","modified_at":"2026-11-10T19:18:53+00:00","first_seen_at":"2026-11-10T19:24:38+00:00","fetched_at":"2026-11-10T19:24:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}