CVE-2026-34342

What it actually does

CVE-2026-34342 is a local privilege escalation vulnerability in Windows Print Spooler Components caused by improper synchronization during concurrent access to a shared resource. A low-privileged, authenticated local attacker can attempt to win a race condition in the Print Spooler workflow and cause privileged spooler operations to act on attacker-influenced state. Successful exploitation can result in execution with elevated privileges, potentially SYSTEM-level access, with full confidentiality, integrity, and availability impact on the affected Windows host. The CVSS score is 7.0, with local access, low privileges, no user interaction, and high attack complexity because exploitation depends on race timing.

Why it matters to the business

If exploited, a user or malware that already has limited access to a Windows workstation or server could gain full control of that machine. This can enable credential theft, disabling of security tools, persistence, lateral movement, and tampering with business applications or data hosted on the system. The vulnerability affects many supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012 through Server 2025, so exposure may be broad in enterprise environments. It is not currently listed in CISA KEV, has no known exploit maturity reported, and has a low stable EPSS score of 0.0029, which lowers immediate internet-scale exploitation likelihood, but privilege escalation vulnerabilities are valuable after initial compromise and should still be remediated through normal patch SLAs, with higher urgency on shared servers, domain-joined systems, print servers, and user-accessible endpoints.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through a compromised user account, malware execution, or interactive access. The attacker then runs exploit code that interacts with Windows Print Spooler Components and repeatedly triggers spooler operations designed to create a timing window around a shared resource. By racing legitimate spooler execution, the attacker attempts to cause the service to use attacker-controlled or stale state while operating in a privileged context. If the race is won, the attacker elevates from a low-privileged account to a highly privileged local security context, commonly enabling SYSTEM-level command execution. The attacker can then dump credentials, install persistence, disable defenses, alter print-spooler-related artifacts, or move laterally using the newly obtained privileges. No named threat actor exploitation or public exploit maturity is currently reported, but exploitation would be most useful as a post-compromise privilege escalation step.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-34342 for all affected Windows versions. Because fixed version numbers were not provided, use the appropriate cumulative update or security-only update from Microsoft for the affected operating system release, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025. Prioritize systems where untrusted users can log on, shared multi-user servers, print servers, domain controllers where the spooler is enabled, and administrator workstations. Where immediate patching is not possible, reduce exposure by disabling the Print Spooler service on systems that do not require printing, restricting who can log on locally or via Remote Desktop, limiting printer driver installation privileges, and enforcing least privilege. Disabling Print Spooler can disrupt local and network printing, so validate operational impact before broad deployment.

How to confirm the fix worked

Confirm remediation by verifying that the relevant Microsoft cumulative/security update released for this vulnerability is installed on each affected Windows version. Use enterprise patch tooling, Windows Update history, Microsoft Update Compliance, WSUS, Configuration Manager, or endpoint management inventory to confirm patch deployment. Validate that unsupported or out-of-date Windows builds have either been upgraded, isolated, or otherwise mitigated. For compensating controls, verify the Print Spooler service state with commands such as `Get-Service Spooler` or `sc query spooler`, and confirm startup type is disabled where printing is not required. Confirm local logon and Remote Desktop access are restricted to authorized users. Because this is a local race condition, network vulnerability scanning alone is unlikely to prove exploitability; use authenticated patch assessment and configuration review instead.

Typical attack path

1. Gain low-privileged local access to an affected Windows workstation or server.
2. Confirm the Print Spooler service and vulnerable Windows build are present.
3. Run local exploit code that repeatedly invokes vulnerable Print Spooler component behavior.
4. Trigger concurrent spooler operations to create a race condition on a shared resource.
5. Win the race so a privileged spooler operation acts on attacker-influenced state.
6. Obtain elevated local privileges, potentially SYSTEM-level execution.
7. Use elevated access to dump credentials, disable controls, establish persistence, or move laterally.

How to detect it

To determine whether this vulnerability may already have been exploited, focus on post-compromise privilege escalation evidence rather than remote ingress. Review Windows Security logs for unusual privilege assignment, process creation, service installation, scheduled task creation, and logon activity around the time a low-privileged user session interacted with printing components. Prioritize Event IDs 4688 for suspicious process creation, 4672 for special privileges assigned to a new logon, 4624 for local or Remote Desktop logons, 7045 in the System log for new service installation, and scheduled task operational events such as 106, 140, 141, and 200. If Sysmon is deployed, review Event ID 1 process creation, Event ID 7 image loads, Event ID 10 process access, Event ID 11 file creation, and Event ID 13 registry value changes. Look for spoolsv.exe spawning command interpreters, scripting engines, LOLBins, credential-dumping tools, or writing unexpected files outside normal spool directories. Review PrintService Operational logs for unusual print-spooler activity preceding elevation events. Examine files under spooler directories, temporary folders, user profile temp paths, service binaries, startup folders, and scheduled task definitions for newly created executables or scripts. Because no public exploit indicators, threat actor names, or ransomware campaigns are currently reported for this CVE, detection should combine spooler anomalies with generic local privilege escalation and post-exploitation telemetry.

• spoolsv.exe spawning cmd.exe
• spoolsv.exe spawning powershell.exe
• spoolsv.exe spawning pwsh.exe
• spoolsv.exe spawning wscript.exe
• spoolsv.exe spawning cscript.exe
• spoolsv.exe spawning rundll32.exe
• spoolsv.exe spawning regsvr32.exe
• spoolsv.exe spawning mshta.exe
• spoolsv.exe spawning certutil.exe
• spoolsv.exe spawning bitsadmin.exe
• spoolsv.exe spawning schtasks.exe
• spoolsv.exe spawning sc.exe
• spoolsv.exe spawning net.exe
• spoolsv.exe spawning net1.exe
• spoolsv.exe spawning whoami.exe
• spoolsv.exe spawning procdump.exe
• spoolsv.exe spawning mimikatz.exe
• C:\Windows\System32\spool\PRINTERS\
• C:\Windows\System32\spool\drivers\
• C:\Windows\System32\spool\drivers\x64\
• C:\Windows\System32\spool\drivers\W32X86\
• Event ID 7045
• Event ID 4688
• Event ID 4672
• Event ID 4624
• Microsoft-Windows-PrintService/Operational
• Microsoft-Windows-TaskScheduler/Operational Event ID 106
• Microsoft-Windows-TaskScheduler/Operational Event ID 140
• Microsoft-Windows-TaskScheduler/Operational Event ID 141
• Microsoft-Windows-TaskScheduler/Operational Event ID 200

What your security team should do

• Inventory all affected Windows client and server versions and identify systems with Print Spooler enabled.
• Patch affected Windows systems with the applicable Microsoft security update, prioritizing multi-user systems, print servers, administrator workstations, and servers that handle sensitive data.
• Disable the Print Spooler service on servers and endpoints that do not require printing, especially domain controllers and high-value servers.
• Restrict local and Remote Desktop logon rights to trusted users and remove unnecessary local administrator privileges.
• Harden print-related policy settings, including restrictions on printer driver installation and Point and Print behavior.
• Monitor for suspicious local privilege escalation behavior involving spoolsv.exe, abnormal child processes, service creation, scheduled task creation, credential dumping, or security tool tampering.
• Treat evidence of exploitation as a post-compromise event: isolate the host, collect forensic artifacts, rotate credentials exposed on the system, and investigate lateral movement.
• Track Microsoft advisories for exact patch identifiers and any later reports of exploit availability, KEV inclusion, or ransomware use.