CVE-2022-41073

What it actually does

CVE-2022-41073 is a local elevation-of-privilege vulnerability in the Windows Print Spooler service. An attacker who already has low-privileged local code execution on an affected Windows workstation or server can exploit a memory-corruption flaw in Print Spooler behavior to gain SYSTEM-level privileges. Successful exploitation provides high impact to confidentiality, integrity, and availability because SYSTEM privileges allow broad control over the local host, including credential access, security control tampering, persistence installation, and lateral movement preparation.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold into full control of a Windows system. Because Windows Print Spooler is widely deployed across desktop and server versions, including Windows 7, 8.1, 10, 11, and Windows Server 2008 through 2022, exposure can be broad in enterprise environments. It is listed in CISA KEV, has been observed exploited in the wild, and is associated with ransomware activity, so unpatched systems can materially increase the likelihood of domain compromise, data theft, operational disruption, and ransomware deployment. The CISA remediation deadline was 2022-12-09, so remaining exposure should be treated as overdue and high priority.

How an attack unfolds

An attacker first obtains local access to an affected Windows host, typically through phishing, stolen credentials, malware execution, exploitation of another vulnerability, or compromise of a low-privileged user account. From that foothold, the attacker checks whether the Print Spooler service is present and running. They then trigger the vulnerable Print Spooler code path using a crafted local interaction that corrupts memory and causes privileged execution within the context of the spooler service or a related privileged process. If successful, the attacker escalates from a standard user context to NT AUTHORITY\SYSTEM. With SYSTEM access, they can dump credentials, disable security tools, install persistence, access sensitive files, pivot to other systems, and support ransomware or hands-on-keyboard intrusion activity.

How to fix it

Apply the relevant Microsoft security updates released for CVE-2022-41073 across all affected Windows versions, including Windows 7, Windows 8.1, Windows 10, Windows 11, and Windows Server 2008, 2012, 2016, 2019, and 2022 systems. Because no discrete product fixed-version list was provided, validate remediation through Microsoft Update, WSUS, Microsoft Configuration Manager, or the Microsoft Security Update Guide for the exact monthly cumulative update applicable to each OS build. Prioritize internet-facing systems, shared workstations, remote-access endpoints, domain controllers, file/print servers, jump hosts, and high-value administrative systems. Where patching cannot be completed immediately, disable the Print Spooler service on systems that do not require printing using service policy or Group Policy. On systems that require printing, restrict who can install printer drivers, reduce local user rights, block unnecessary remote spooler access, and monitor closely for privilege-escalation behavior. Long-term, remove unsupported Windows versions or isolate them until fully remediated.

How to confirm the fix worked

Confirm each Windows host has the applicable Microsoft security update installed for its OS build using Windows Update history, WSUS/SCCM compliance reporting, PowerShell hotfix inventory, or vulnerability scanning. Validate that unsupported or legacy Windows systems are either patched through supported extended servicing channels, isolated, or retired. For mitigated systems, confirm the Print Spooler service is disabled where printing is not required by checking the Spooler service startup type and runtime state. Validate that Point and Print and printer-driver installation policies are hardened. Re-scan endpoints with authenticated vulnerability assessment tools and verify the vulnerability no longer appears. On representative systems, confirm the Spooler service configuration matches the business need and that users without administrative rights cannot perform printer-driver installation or other risky spooler operations.

Typical attack path

1. Gain low-privileged local access to an affected Windows workstation or server.
2. Confirm the Windows Print Spooler service is installed, enabled, or running.
3. Execute or stage a local exploit targeting the Print Spooler elevation-of-privilege flaw.
4. Trigger memory corruption in the vulnerable spooler component to execute code with elevated privileges.
5. Obtain NT AUTHORITY\SYSTEM or equivalent local administrative control.
6. Disable defenses, dump credentials, install persistence, or move laterally using the elevated context.
7. Use the compromised host as a platform for broader intrusion activity, including ransomware deployment where applicable.

How to detect it

To determine whether this vulnerability was already exploited, focus on evidence of local privilege escalation and subsequent post-exploitation activity around the Print Spooler service. Review Windows Security logs for unusual process creation, privilege assignment, service creation, scheduled task creation, and account changes, especially where a low-privileged user session is followed by SYSTEM-level execution. Useful event sources include Windows Security events 4688, 4672, 4624, 4627, 4732, 4720, 7045 from the System log, Microsoft-Windows-PrintService/Operational logs, PowerShell Operational logs, Sysmon telemetry, EDR process trees, driver installation logs, and spooler crash or service restart events. Look for suspicious child processes spawned from spoolsv.exe, unexpected writes in spool directories, printer-driver installation anomalies, unsigned or unusual DLLs related to printing, and service restarts or crashes around the time of suspicious user activity. Because exploitation may not leave a unique string, also hunt for follow-on ransomware tradecraft: credential dumping tools, LSASS access, new local administrators, disabled security services, shadow copy deletion, lateral movement tooling, and mass file modification. If threat-intelligence reporting identifies specific campaigns in your telemetry, correlate unpatched exposure windows with those campaign indicators and any SYSTEM-level activity initiated from non-administrative accounts.

• spoolsv.exe spawning cmd.exe
• spoolsv.exe spawning powershell.exe
• spoolsv.exe spawning pwsh.exe
• spoolsv.exe spawning wscript.exe
• spoolsv.exe spawning cscript.exe
• spoolsv.exe spawning rundll32.exe
• spoolsv.exe spawning regsvr32.exe
• spoolsv.exe spawning mshta.exe
• spoolsv.exe spawning certutil.exe
• spoolsv.exe spawning bitsadmin.exe
• C:\\Windows\\System32\\spool\\drivers\\
• C:\\Windows\\System32\\spool\\PRINTERS\\
• C:\\Windows\\System32\\spool\\drivers\\x64\\3\\
• C:\\Windows\\System32\\spool\\drivers\\W32X86\\3\\
• Service Control Manager Event ID 7045
• Microsoft-Windows-PrintService/Operational
• The Print Spooler service terminated unexpectedly
• The Print Spooler service entered the running state
• SeDebugPrivilege
• vssadmin.exe Delete Shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled No
• NT AUTHORITY\\SYSTEM

What your security team should do

• Treat remaining exposure as urgent because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware campaigns.
• Patch all affected Windows endpoints and servers with the applicable Microsoft cumulative/security update; verify coverage through authenticated inventory rather than relying only on patch deployment status.
• Disable the Print Spooler service on servers and workstations that do not require local or network printing, especially domain controllers, identity infrastructure, backup servers, jump hosts, and administrative workstations.
• Prioritize investigation of systems where low-privileged users executed unusual binaries, scripts, or exploit tooling followed by SYSTEM-level process creation.
• Hunt for post-exploitation behavior rather than relying on a single exploit signature, including credential dumping, security-tool tampering, new services, scheduled tasks, suspicious driver installation, and unexpected spooler activity.
• Review local administrator group membership, recently created accounts, new services, scheduled tasks, and persistence mechanisms on systems that were unpatched after the vulnerability became public.
• Ensure EDR protections are enabled and tamper protection is active on all Windows systems, with alerting for privilege escalation from user context to SYSTEM.
• For legacy Windows versions, develop a retirement or isolation plan if they cannot be reliably patched and monitored.