Exploiting Reversing (ER) Series | Article 11: Windows: Missing Bounds in the Print Spooler.
The article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.
Published on:
https://www.blackstormsecurity.com/research/
What it covers:
[+] The bug: a heap overflow (CWE-122) in the Print Spoolers form-enumeration path, reachedthrough InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.
[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.
[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.
[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.
This article will be published on https://exploitreversing.com/ next week.
Hope you enjoy the read!
#Windows #PrintSpooler #VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #HeapExploitation
