The Windows Print Spooler service has an unpatched critical flaw that’s been dubbed “PrintNightmare.” Microsoft warns people about the vulnerability and breaks down how it works in a recent post:
“A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,” says the company. “An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
According to Microsoft, the vulnerability is being actively exploited.
The vulnerability appears to have been accidently published in the form of a proof-of-concept exploit. Sangfor researchers published the proof-of-concept but have since deleted it. Unfortunately, the code was forked on GitHub before it was removed.
As explained by The Verge, the researchers at Sangfor appeared to have thought the vulnerability had been patched by Microsoft. The company had patched issues related to Windows Print Spooler, but they were not for this specific issue.
Microsoft lists two options as workarounds for the issue:
- Disable the Print Spooler service
- Disable inbound remote printing through Group Policy
While publicly known as PrintNightmare, Microsoft has assigned the name CVE-2021-34527 to the vulnerability.
Microsoft is still investigating the severity of this vulnerability. The company is also investigating if all versions of Windows are exploitable.
“The code that contains the vulnerability is in all versions of Windows,” says Microsoft. “We are still investigating whether all versions are exploitable. We will update this CVE when that information is evident.”
We may earn a commission for purchases using our links. Learn more.