---
id: "CVE-2026-113752"
page: "https://infrastack.ai/live/CVE-2026-113752"
kind: "vulnerability"
aliases: ["CVE-2026-113752"]
title: "Windows Print Spooler: use-after-free lets a nearby attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 Version 1607", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 Version 1809", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "print-spooler", "self-hosted", "windows"]
not_affected_if: ["no-adjacent-network-access", "spooler-disabled"]
published_at: "2026-11-10T19:18:53+00:00"
first_seen_at: "2026-11-10T19:24:38+00:00"
updated_at: "2026-11-10T23:57:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113752", "first_seen_at": "2026-11-10T19:24:38+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113752", "first_seen_at": "2026-11-10T23:57:46+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-113752"]}]
exploit_sources: []
---

# Windows Print Spooler: use-after-free lets a nearby attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-113752 (this .md is for agents)

A use-after-free bug in the Windows Print Spooler components lets an unauthorized attacker run code on an affected Windows machine. The attack works over an adjacent network, so the attacker must be on the same local network segment.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10 Version 1607 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 10 Version 1809 affected < 10.0.17763.9487 fixed 10.0.17763.9487

## How to check

Run Get-Service Spooler in PowerShell; if it is Running, check the build with winver or [System.Environment]::OSVersion.Version and compare with the fixed builds (Win10 1607: 10.0.14393.9688, 1809: 10.0.17763.9487; other versions per MSRC). Also check whether hosts share a network segment with untrusted devices.

## Fix

Install the November 2026 Windows cumulative update for your version. Known fixed builds: Windows 10 1607 10.0.14393.9688, Windows 10 1809 10.0.17763.9487. Other versions: see the Microsoft Security Update Guide entry (not read).

## Timeline

- 2026-11-10T19:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113752
- 2026-11-10T23:57:46+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-113752 — MSRC guide page is JS-only and unreadable here; used NVD (carries Microsoft CNA affected list, only partly visible). Fixed builds known for Win10 1607 and 1809 only; nothing verified. No exploitation or PoC seen (Rapid7: not KEV, no EPSS). Revisit with MSRC page or KB list.

## Documents

- [describes] NVD CVE-2026-113752 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-113752

## From the sources

Use after free in Windows Print Spooler Components allows an unauthorized attacker to execute code over an adjacent network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_