CVE-2026-55004

What it actually does

CVE-2026-55004 is a local privilege escalation vulnerability caused by a double-free memory corruption condition in Microsoft Printer Drivers. A low-privileged, authenticated local attacker can trigger unsafe memory reuse in the printer driver handling path and potentially execute code with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability on the affected Windows system. The attack requires local access or an existing low-privileged foothold, but does not require user interaction.

Why it matters to the business

Successful exploitation could allow an attacker who already has limited access to a Windows workstation or server to become an administrator or SYSTEM-level user. This can turn an initial foothold from phishing, stolen credentials, malware, or exposed remote access into full endpoint or server compromise, enabling credential theft, security tool tampering, lateral movement, data access, and deployment of additional malware. Although this vulnerability is not currently listed in CISA KEV and no mature public exploit is reported, the affected product set spans many supported Windows desktop and server versions, so organizations should treat patching as a standard high-priority endpoint and server maintenance item.

How an attack unfolds

An attacker first obtains authenticated local access to an affected Windows system, such as through a compromised user account, malware running as a standard user, or interactive access via RDP or another remote management path. The attacker then invokes printer-driver-related functionality in a way that triggers the double-free condition. If exploitation is successful, the attacker manipulates the resulting memory corruption to run code in a more privileged security context. With elevated privileges, the attacker can disable protections, dump credentials, install persistence, access sensitive files, modify system configuration, or use the host as a staging point for broader compromise.

How to fix it

Apply the latest Microsoft security updates or cumulative updates for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no specific fixed build or KB is provided in the input, use Microsoft’s official Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or an approved patch-management platform to identify and deploy the applicable update for each OS release. As compensating controls, disable the Print Spooler service on systems that do not require printing, especially servers and domain controllers; restrict printer driver installation to administrators; limit Point and Print to trusted print servers; remove unnecessary local printer drivers; and enforce least privilege for interactive and remote logon users.

How to confirm the fix worked

Confirm that all affected systems have installed the applicable Microsoft security update released for this vulnerability or a later cumulative update. Validate patch status through Windows Update history, enterprise patch-management reporting, vulnerability scanner results, or commands such as Get-HotFix where applicable. Check OS build numbers against Microsoft’s published fixed build guidance for each Windows release. Verify that Print Spooler is disabled on systems where it is not needed, and confirm printer driver installation restrictions are enforced through Group Policy or equivalent endpoint configuration management. Rescan representative workstations and servers after patch deployment to confirm the vulnerability is no longer reported.

Typical attack path

1. Gain low-privileged authenticated access to an affected Windows workstation or server.
2. Determine that the target OS version and printer driver components are vulnerable and unpatched.
3. Trigger vulnerable Microsoft Printer Driver functionality locally.
4. Exploit the double-free memory corruption condition to elevate privileges.
5. Execute commands or payloads with administrator or SYSTEM-level privileges.
6. Establish persistence, collect credentials, disable defenses, or move laterally to other systems.

How to detect it

Detection should focus on evidence of local privilege escalation and suspicious printer subsystem activity because exploitation occurs locally and may not produce a unique network signature. Review Windows Security logs for unusual process creation, special privilege assignment, new service creation, local administrator group changes, and logons followed by rapid privilege changes. Review Microsoft-Windows-PrintService/Admin and Operational logs for unexpected printer driver installation, driver updates, print spooler errors, or printer configuration activity by non-administrative users. Review System logs for Print Spooler service crashes or restarts, especially Service Control Manager events indicating spoolsv.exe terminated unexpectedly. If Sysmon or EDR telemetry is available, hunt for spoolsv.exe crashes, unusual child processes spawned around printer activity, suspicious DLL loads from printer driver directories, new files under Windows spool driver paths, and post-exploitation tools executed shortly after printer subsystem events. Also review Windows Error Reporting artifacts for spoolsv.exe or printer-driver-related faulting modules. Since no public exploit maturity or known KEV exploitation is reported, absence of these artifacts does not prove non-exploitation, but clustered spooler instability plus privilege-change activity should be treated as suspicious.

• spoolsv.exe
• Microsoft-Windows-PrintService/Admin
• Microsoft-Windows-PrintService/Operational
• The Print Spooler service terminated unexpectedly
• Service Control Manager event ID 7031
• Service Control Manager event ID 7034
• Windows Security event ID 4672
• Windows Security event ID 4688
• Windows Security event ID 4697
• Windows Security event ID 4732
• Sysmon event ID 1
• Sysmon event ID 7
• C:\\Windows\\System32\\spool\\drivers\\
• C:\\Windows\\System32\\spool\\PRINTERS\\
• C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_spoolsv.exe
• C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_spoolsv.exe

What your security team should do

• Prioritize patching internet-adjacent management hosts, shared workstations, jump servers, print servers, and systems used by administrators.
• Deploy the latest cumulative Microsoft updates for all affected Windows desktop and server versions through centralized patch management.
• Disable the Print Spooler service on servers and sensitive systems that do not require printing.
• Enforce policy that only administrators can install printer drivers and restrict Point and Print to approved print servers.
• Monitor for unusual spooler crashes, printer driver installation events, and privilege escalation activity following low-privileged logons.
• Hunt for post-exploitation behavior such as new local administrators, credential dumping tools, suspicious child processes, and security control tampering.
• Review exposure of RDP and other remote access paths, since local privilege escalation vulnerabilities are commonly chained after initial access.