CVE-2022-41073: Windows Print Spooler out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a locally exploitable privilege escalation in a widely deployed Windows component that CISA lists as known exploited and associated with ransomware, though it requires an existing foothold.

What it is

Windows Print Spooler contains an out-of-bounds write (CWE-787) that allows a local user to elevate privileges. It affects a broad set of Windows client and server releases, and Microsoft has issued a patch. Because it is a privilege escalation in a core Windows service, it matters as a post-compromise step to gain higher rights on a host.

Impact

An attacker who already has a foothold and low-privileged code execution can exploit the flaw to gain elevated privileges on the affected system. That access can then be used to disable defenses, move laterally, or deploy payloads such as ransomware.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so it is reached by running code on the target machine rather than over the network. No remote or unauthenticated path is described in the record.

Exploitation

CVE-2022-41073 is listed in CISA's Known Exploited Vulnerabilities catalog with a due date of 2022-12-09 and is flagged for known ransomware campaign use. EPSS 30-day probability is 0.0226 (82nd percentile), and references include a third-party advisory and the CISA KEV entry.

What to do

• Apply the Microsoft update for CVE-2022-41073 on all affected Windows client and server versions.
• Prioritize patching internet-facing and high-value servers, and any host where the Print Spooler service is not required.
• Disable or restrict the Print Spooler service on systems that do not need printing, per Microsoft guidance.
• Restrict local logon and code execution rights to reduce the pool of users who can trigger the flaw.
• Monitor for and remediate any signs of prior exploitation, since KEV lists known ransomware use.

Detection

• Monitor for unexpected elevation of privilege events and suspicious child processes spawned from spoolsv.exe.
• Alert on unusual writes or crashes in the Print Spooler service and on new local admin account creation.
• Hunt for known exploitation artifacts referenced in the Packet Storm advisory and correlate with KEV timelines.
• Audit hosts still running unpatched Windows builds listed in the affected product set.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.