CVE WatchAug 10, 2026

CVE-2022-41073

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

CVSS

7.8

High

EPSS

2.4%

p83

KEV

YES

Nov 8, 2022

Exploit Today

0-100

Published: Nov 9, 2022 · Last modified: Aug 10, 2026 · CWE-787

EPSS · 30d

2.3%EPSS · 30 days2.4%

2026-09-172026-10-15

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Added to KEV

Nov 8, 2022

Remediate by

Dec 9, 2022

Known ransomware use

Yes

Summary description

Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.

Required action

Apply updates per vendor instructions.

Notes

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073; https://nvd.nist.gov/vuln/detail/CVE-2022-41073

Technical description

Windows Print Spooler Elevation of Privilege Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-890625.5 MED

—

———A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.7h CVE-2026-1112807.4 HIG

—

———snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.9h CVE-2026-1112756.1 MED

—

———nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.9h CVE-2026-1112706.1 MED

—

———libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.9h CVE-2026-1111616.1 MED

—

——0libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.11h CVE-2026-1111576.1 MED

—

——0SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().12h