CVE-2022-41073

CVE-2022-41073 is an out-of-bounds write flaw (CWE-787) in the Microsoft Windows Print Spooler that allows a local, low-privileged user to elevate privileges (CVSS 3.1: 7.8, local attack vector, no user interaction required). It is triggered when the spooler service processes maliciously crafted content on the local machine, letting an attacker who already has a foothold run code at higher privileges. Successful exploitation effectively grants elevated (up to SYSTEM-level) control of the host, which attackers typically use to persist and move toward domain or ransomware objectives after initial access. Affected systems are essentially all listed Windows client and server editions with the Print Spooler running (enabled by default), spanning Windows 7 through Windows 11 22H2 and Windows Server 2008. The vulnerability was being actively exploited when Microsoft patched it in the November 2022 release, CISA added it to the KEV catalog on 2022-11-08 with ransomware use known, and no public PoC is cataloged despite confirmed in-the-wild exploitation.

What to do: Apply Microsoft's November 2022 security updates across all affected Windows versions, prioritizing domain controllers, file/print servers, and other shared or internet-reachable hosts, consistent with CISA's required KEV action. Where patching must wait and printing is not required, disable or restrict the Print Spooler service as an interim mitigation, noting this breaks local and network printing. Because exploitation is confirmed in the wild and linked to ransomware activity, hunt for signs of local privilege escalation on endpoints that were unpatched as of the November 2022 Patch Tuesday.