CVE-2026-70564

CVE-2026-70564 is a heap-based buffer overflow (CWE-122) in the Windows Print Spooler components, rated High (7.8) under CVSS 3.1. It is triggered locally: an attacker who already holds low-privileged authorized access on a Windows machine can invoke spooler functionality with malformed input that overflows a heap buffer, with no user interaction required. Successful exploitation yields elevated (SYSTEM-level) privileges on that local machine, giving the attacker full control of the host. Any Windows system running the Print Spooler service — workstations and servers alike — is potentially in scope, per Microsoft's advisory. Exploitation status is currently quiet: there is no known public PoC, the flaw is not in CISA's KEV, and EPSS estimates only ~0.3% probability of exploitation in the next 30 days (25th percentile).

What to do: Apply the Microsoft security update that addresses CVE-2026-70564 as soon as it is available via Windows Update or the Microsoft advisory, and verify your hosts are on a patched build. As an interim mitigation, disable the Print Spooler service on systems that do not need printing (common on many servers), which removes the attack surface entirely. On shared or multi-user hosts, restrict local low-privilege sign-in to trusted accounts since exploitation requires local access.