{"id":"CVE-2026-113770","kind":"vulnerability","aliases":["CVE-2026-113770"],"related":[],"title":"Windows Print Spooler: local user can gain elevated privileges","description":"Untrusted pointer dereference in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"A pointer in Windows Print Spooler components is dereferenced without validation. An authorized local attacker can use it to raise their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">=10.0.19044.0, <10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">=10.0.19045.0, <10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">=10.0.22631.0, <10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">=10.0.26100.0, <10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">=10.0.26200.0, <10.0.26200.9974","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local","print-spooler","privilege-escalation","title-review","windows"],"not_affected_if":["patched","spooler-disabled","unknown"],"how_to_check":"Run winver or [Environment]::OSVersion.Version in PowerShell and compare the build with the fixed builds listed in the fix. Windows Server builds not confirmed; check the MSRC page.","fix":"Install the November 2026 Windows cumulative update: Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2 10.0.26100.9974, Win11 25H2 10.0.26200.9974 (per OffSeq's copy of the CVE record; confirm in MSRC).","status":"open","published_at":"2026-11-10T19:18:56+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T19:52:14+00:00","updated_at":"2026-11-10T23:52:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:52:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: local user can gain elevated privileges","impact":"high","summary":"A pointer in Windows Print Spooler components is dereferenced without validation. An authorized local attacker can use it to raise their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local account gains higher privileges on the Windows machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed versions and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Print Spooler","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Machines running Windows with the Print Spooler component are the systems in scope; the sources do not list affected Windows builds. An attacker needs a local account on the machine first. unknown for anything beyond that.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4494,"output_tokens":422,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed versions and the patch.","search":"'-113770':12A,15A '-2026':11A,14A '10':17A,20A '11':23A,26A,29A '21h2':18A '22h2':21A '23h2':24A '24h2':27A '25h2':30A 'allow':76C 'attack':57B,79C 'author':55B,78C 'compon':49B,75C 'cve':10A,13A 'derefer':70C 'dereferenc':51B 'elev':8A,81C 'escal':38B 'gain':7A 'infrastructur':31B 'local':4A,32B,56B,83C 'machin':67B 'pointer':44B,69C 'print':2A,34B,47B,73C 'print-spool':33B 'privileg':9A,37B,64B,82C 'privilege-escal':36B 'rais':62B 'review':41B 'spooler':3A,35B,48B,74C 'titl':40B 'title-review':39B 'untrust':68C 'use':59B 'user':5A 'valid':53B 'window':1A,42B,46B,72C 'windows':16A,19A,22A,25A,28A 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 21H2/22H2 and Windows 11 23H2/24H2/25H2 machines below the fixed builds, where the Print Spooler is present. An attacker needs a local low-privilege account first, and Microsoft rates attack complexity high. Multi-user machines, shared workstations and terminal servers matter most; Server editions are unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","1123h2","1124h2","1125h2","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2"],"ptokens":["10","11","21h2","22h2","23h2","24h2","25h2","windows"],"labels":["high","infrastructure","local","printspooler","privilegeescalation","titlereview","vendor","windows"],"campaign_type":null,"search_a":"'-113770':12A,15A '-2026':11A,14A '10':17A,20A '11':23A,26A,29A '21h2':18A '22h2':21A '23h2':24A '24h2':27A '25h2':30A 'cve':10A,13A 'elev':8A 'gain':7A 'local':4A 'print':2A 'privileg':9A 'spooler':3A 'user':5A 'window':1A 'windows':16A,19A,22A,25A,28A","search_b":"'attack':57B 'author':55B 'compon':49B 'dereferenc':51B 'escal':38B 'infrastructur':31B 'local':32B,56B 'machin':67B 'pointer':44B 'print':34B,47B 'print-spool':33B 'privileg':37B,64B 'privilege-escal':36B 'rais':62B 'review':41B 'spooler':35B,48B 'titl':40B 'title-review':39B 'use':59B 'valid':53B 'window':42B,46B 'without':52B","search_c":"'allow':76C 'attack':79C 'author':78C 'compon':75C 'derefer':70C 'elev':81C 'local':83C 'pointer':69C 'print':73C 'privileg':82C 'spooler':74C 'untrust':68C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113770","severity":null,"published_at":"2026-11-10T19:18:56+00:00","modified_at":"2026-11-10T19:18:57+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113770:3247","url":"https://radar.offseq.com/threat/cve-2026-113770-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-21h2-fa50b07e3b0d534b","severity":null,"published_at":"2026-11-10T23:52:43+00:00","modified_at":"2026-11-10T23:52:43+00:00","first_seen_at":"2026-11-10T23:52:43+00:00","fetched_at":"2026-11-10T23:52:43+00:00","note":"MSRC page not readable (JS-only), so nothing verified. Builds and fixes come from OffSeq's copy of the CVE record (secondary). Not in KEV, no PoC found, Microsoft temporal E:U. Windows Server builds not listed in what I read.","cites":["https://radar.offseq.com/threat/cve-2026-113770-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-21h2-fa50b07e3b0d534b","https://www.rapid7.com/db/vulnerabilities/cve-2026-113770/"]}],"documents":[{"id":120480,"url":"https://radar.offseq.com/threat/cve-2026-113770-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-21h2-fa50b07e3b0d534b","title":"OffSeq Threat Radar: CVE-2026-113770 (rewrite of CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120481,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-113770/","title":"Rapid7 DB: CVE-2026-113770","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}