Vulnerability record · CVE-2012-1851 · published 15 August 2012
CVE-2012-1851: Windows Print Spooler format string remote code execution
Microsoft · Windows 7
The Windows Print Spooler service contains a format string vulnerability (CWE-134) that can be triggered by a crafted response. A remote, unauthenticated attacker can exploit it to run arbitrary code with system privileges on affected Windows XP, Server 2003, Vista, Server 2008, and Windows 7 systems.
Description
Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability."
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 score of 10 with network, unauthenticated, low-complexity code execution and a very high EPSS percentile make this a top remediation priority despite no KEV listing.
What it is
The Windows Print Spooler service contains a format string vulnerability (CWE-134) that can be triggered by a crafted response. A remote, unauthenticated attacker can exploit it to run arbitrary code with system privileges on affected Windows XP, Server 2003, Vista, Server 2008, and Windows 7 systems.
Impact
Successful exploitation gives the attacker arbitrary code execution in the context of the Print Spooler service, typically SYSTEM, allowing full compromise of the host.
Attack surface
The vulnerability is network-reachable (AV:N) with no authentication (Au:N) and low complexity (AC:L), so it can be triggered by sending a crafted response to the spooler service. No user interaction is indicated by the vector or description.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.656, 99.2nd percentile), indicating elevated predicted exploitation activity.
What to do
- Apply Microsoft security bulletin MS12-054 for the affected Windows versions.
- Disable or restrict the Print Spooler service on hosts that do not require printing.
- Block inbound SMB/RPC print spooler traffic at network boundaries and segment print infrastructure.
- Upgrade or migrate off the unsupported Windows XP, Server 2003, Vista, and Server 2008 platforms.
- Monitor for anomalous spooler service crashes or restarts as an exploitation indicator.
Detection
- Monitor Windows System and Application event logs for Print Spooler service crashes or unexpected restarts.
- Alert on unusual RPC or SMB traffic to the spooler service from untrusted network segments.
- Track process creation events where spoolsv.exe spawns unexpected child processes.
- Correlate host telemetry for code execution in spoolsv.exe context with inbound print-related network connections.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1851 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1851), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
