CVE-2026-69602

CVE-2026-69602 is a use-after-free (CWE-416) in the Windows Print Workflow User Service (PrintWorkflowUserSvc), a per-user component of the Windows print pipeline. According to Microsoft's description, an authorized (low-privileged) attacker can trigger the flaw over a network when the service mishandles an object during print workflow processing, freeing memory that is then reused; the CVSS vector indicates high attack complexity and user interaction are required. Successful exploitation allows the attacker to elevate privileges on the affected system, with high impact on confidentiality, integrity, and availability. Any Windows system running the Print Workflow service is affected; the provided data does not enumerate specific Windows releases, so defenders should consult Microsoft's advisory for the affected version list. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.6% (~45th percentile) suggests limited near-term exploitation risk.

What to do: Apply Microsoft's security update for CVE-2026-69602 via the current Windows cumulative update, prioritizing multi-user systems (RDS/VDI, shared hosts, print servers) where untrusted or low-privileged accounts can log in. Because the bug requires authentication and user interaction with high attack complexity, restricting interactive access to untrusted users and monitoring PrintWorkflowUserSvc errors/crashes limits interim risk. Verify affected Windows versions and applicable KBs against Microsoft's advisory, since the provided data does not list specific version ranges.