A use after free vulnerability in the Windows PrintWorkflowUserSvc service enables local privilege escalation on affected Microsoft Windows systems.

This is a use after free vulnerability (CWE-416) within the Windows PrintWorkflowUserSvc component. An attacker must possess local, authorized user-level access to trigger the flaw and elevate privileges.

Successful exploitation of this vulnerability allows an attacker to escalate privileges to a higher level of access than originally assigned. With a CVSS score of 7.8, the potential for total system compromise is significant, as elevated local privileges are often a prerequisite for further lateral movement or full persistence within the environment.

Immediate Action: Update affected systems to the version 10.0.26100.4946 or later as specified in the Microsoft security update guide.

Proactive Monitoring: Review system logs for unusual behavior related to the PrintWorkflowUserSvc service and monitor for unauthorized attempts to escalate privileges or unexpected process executions.

Compensating Controls: Ensure that local user permissions follow the principle of least privilege to limit the impact of a potential compromise.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation, organizations should prioritize the deployment of the provided Microsoft security updates. Applying these patches immediately is the most effective way to eliminate the risk of exploitation on local Windows systems.