CVE-2026-57085

What it actually does

This vulnerability is an out-of-bounds read in Windows Print Spooler components. A local authenticated attacker can cause the spooler-related code to read memory outside the intended buffer, potentially exposing sensitive information from the local system process memory space. The flaw does not provide direct code execution or privilege escalation by itself, but the disclosed data could help bypass mitigations, reveal secrets, or support a follow-on local attack.

Why it matters to the business

Successful exploitation could expose sensitive information from affected Windows workstations and servers, including systems running Windows 10, Windows 11, and multiple Windows Server versions. Because exploitation requires local authenticated access, the main business risk is post-compromise data exposure or attacker enablement after an account or endpoint has already been accessed. The issue is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so it is a lower-priority emergency than actively exploited vulnerabilities, but it should still be remediated through normal Windows patch cycles, especially on shared systems, print servers, servers with many local users, and high-value administrative workstations.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system. They then interact with vulnerable Windows Print Spooler functionality in a way that triggers an out-of-bounds memory read. If successful, the vulnerable component returns or exposes memory contents beyond the intended bounds. The attacker analyzes the disclosed data for useful information such as memory layout details, sensitive process data, or values that can assist exploitation of another vulnerability. Because the flaw is local and information-disclosure-only, it is most useful as part of a broader attack chain rather than as an initial access technique.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-57085 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 where applicable. Because no fixed version list was provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the relevant July 2026 or later cumulative/security updates for each supported OS build. Where immediate patching is not possible, reduce exposure by disabling the Print Spooler service on systems that do not require printing, restricting local logon rights, limiting interactive access to servers, and hardening endpoint controls to prevent untrusted local code execution. On print servers or systems that require printing, avoid disabling the service without validating operational impact, but prioritize patching and access control.

How to confirm the fix worked

Confirm affected systems have installed the Microsoft security update containing the fix by checking Windows Update history, enterprise patch management compliance, or installed cumulative update KBs for the relevant OS build. Validate that the OS build number is at or above the patched baseline published by Microsoft for the affected product. Where mitigation was chosen instead of patching, confirm the Print Spooler service is disabled or restricted only on systems where printing is not required. Security teams can also verify exposure by inventorying Windows endpoints and servers with the Print Spooler service installed or running, then correlating them against patch compliance data. A system should be considered remediated only when the applicable security update is installed or the vulnerable component is not operationally reachable due to a deliberate, validated mitigation.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Identify that Windows Print Spooler components are present and unpatched.
3. Invoke the vulnerable Print Spooler functionality using a crafted local request or operation.
4. Trigger an out-of-bounds read condition in the vulnerable component.
5. Recover disclosed memory contents or process-derived information.
6. Use the disclosed information to support follow-on activity, such as bypassing exploit mitigations, improving reliability of another exploit, or identifying sensitive local data.

How to detect it

Detection should focus on signs of attempted local exploitation or broader post-compromise activity rather than a unique network signature, because this is a local information disclosure issue and no public exploit indicators are currently known. Review Windows Event Logs, especially System, Security, Microsoft-Windows-PrintService/Admin, Microsoft-Windows-PrintService/Operational, and application crash telemetry for unusual Print Spooler behavior. Look for repeated spooler service failures, abnormal local user interaction with print components, suspicious child processes or tooling launched near spooler errors, and exploitation attempts followed by credential access, privilege escalation, or lateral movement. Endpoint detection telemetry should be reviewed for unexpected access to spooler-related binaries, drivers, and spool directories by non-administrative users. Because successful exploitation may leave limited artifacts, prioritize correlation: local authenticated user activity, spooler anomalies, process execution, crash events, memory-dump creation, and follow-on suspicious behavior on the same host.

What your security team should do

• Prioritize patching shared Windows systems, print servers, jump hosts, administrative workstations, and servers that allow interactive logon by multiple users.
• Deploy the applicable Microsoft cumulative/security updates through standard patch management and confirm installation by OS build or KB compliance.
• Disable the Print Spooler service on servers and workstations that do not require printing, especially domain controllers and high-value infrastructure systems.
• Restrict local and interactive logon rights to reduce the number of users who can exploit a local authenticated information disclosure flaw.
• Monitor for unusual local interaction with Print Spooler components, repeated spooler service crashes, or suspicious tooling executed by non-administrative users.
• Treat any suspected exploitation as a possible component of a broader local attack chain and investigate for credential theft, privilege escalation attempts, and additional exploit activity.
• Because the vulnerability is not currently in CISA KEV, has low EPSS, and has no known public exploit maturity, handle it through normal risk-based patch cycles unless sensitive systems or compensating-control gaps justify acceleration.