Threat reportVulnerabilityTL-2026-4578
Windows Print Spooler Heap Overflow in Form Enumeration (InternalEnumForms/CopyIniFormToFormInfo/PackStrings memcpy) — Unpatched, Public 60-Page Exploit Write-Up
Windows Print Spooler Heap Overflow in Form Enumeration (TL-2026-4578), also tracked as ER Series Article 11, is a medium-severity software vulnerability, first published 2026-10-27. It has no confirmed attribution, affects Microsoft Windows Print Spooler (spoolsv.exe), references 3 CVEs (CVE-2026-85877, CVE-2021-1675, CVE-2021-34527), maps to 3 MITRE ATT&CK techniques (T1078.003, T1106, T1587.004), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4578
- Threat ID
- TL-2026-4578
- Also known as
- ER Series Article 11, Exploiting Reversing Article 11, Windows: Missing Bounds in the Print Spooler
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise it, all sectors running windows print spooler
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Windows Print Spooler Heap Overflow in Form Enumeration
Malware and tooling: IDA Pro (Hex-Rays)
How Windows Print Spooler Heap Overflow in Form Enumeration works
Security researcher Alexandre Borges published a 60-page write-up and working exploit for an unpatched heap overflow (CWE-122) in the Windows Print Spooler (spoolsv.exe) form-enumeration path InternalEnumForms -> CopyIniFormToFormInfo -> PackStrings -> memcpy. The bug was submitted to Microsoft in March 2026; MSRC judged it below the bar for immediate servicing because triggering it requires administrative privileges, and it remains exploitable on current mainstream and Canary builds as of October 2026.
Article 11 of Alexandre Borges' 'Exploiting Reversing' (ER) series, titled 'Windows: Missing Bounds in the Print Spooler', documents a heap overflow (CWE-122) in the user-mode Windows Print Spooler service, spoolsv.exe. The vulnerable path is the form-enumeration code: InternalEnumForms calls CopyIniFormToFormInfo, which calls PackStrings, whose memcpy writes beyond the intended bounds of the heap buffer. The title of the article refers to this as 'missing bounds'.
The accompanying PDF (about 60 pages) describes the exploitation in four stages: groom, corrupt, control and execute. Per the Blackstorm Security research listing, the exploit grooms the Windows Segment Heap's Variable-Size allocator and then corrupts function pointers to achieve code execution inside spoolsv.exe. The author states that after exploitation the spooler service keeps running without crashing and the planted form used to trigger the bug is deleted afterward, which reduces the observable footprint (no service crash, no lingering form entry).
Microsoft was informed in March 2026. According to the article, MSRC responded in October 2026 that the report falls below the bar for immediate servicing because exploitation requires administrative privileges. The article states the issue is still reproducible as of October 2026 on current mainstream Windows builds and on Windows Insider Canary builds. No CVE identifier and no CVSS score has been published, and the sources do not describe in-the-wild exploitation, a threat actor, or network or malware IOCs. This is public vulnerability research with an exploit write-up and a video, not an observed campaign.
Operational significance: because spoolsv.exe runs as LocalSystem (standard Windows behavior), a successful exploit would turn administrator-level access into SYSTEM-level code execution inside a trusted signed service, which matters mainly for environments that treat local administrator accounts as a security boundary (tiered administration, PAWs, delegated admin). The Print Spooler's RPC-exposed form-management interface (MS-RPRN: RpcAddForm, RpcEnumForms Opnum 34, RpcSetForm, RpcDeleteForm; Win32 AddForm/EnumForms) is a long-standing attack surface — see PrintNightmare (CVE-2021-1675 / CVE-2021-34527) and the recent Print Spooler heap-overflow record CVE-2026-85877. The article does not state any relationship between this bug and those CVEs, and none is asserted here. Borges credits Ilfak Guilfanov and Hex-Rays SA for support, consistent with IDA Pro being used for reverse engineering. The function-level details beyond those named in the article's summary could not be extracted from the PDF by this analysis (binary PDF not machine-readable in this environment) and are therefore not stated.
MITRE ATT&CK techniques used in TL-2026-4578
Privilege Escalation
Execution
Resource Development
Affected products and versions in Windows Print Spooler Heap Overflow in Form Enumeration
- Microsoft — Windows Print Spooler (spoolsv.exe)
Vulnerable versions: Current mainstream Windows builds as of October 2026; Windows Insider Canary channel builds as of October 2026
Remediation for Windows Print Spooler Heap Overflow in Form Enumeration
Patches
- No vendor patch exists for this finding as of 2026-10-27; MSRC assessed it as below the bar for immediate servicing
Immediate actions
- Limit the number of principals holding local Administrator rights on systems running the Print Spooler, since exploitation requires administrative privileges
- Disable the Print Spooler service on servers and domain controllers or any host that does not need to print
- Apply privileged-access tiering / Privileged Access Workstations so that a compromised admin session cannot trivially be converted into SYSTEM code execution
- Monitor spoolsv.exe for unexpected crashes, restarts, child processes, module loads and anomalous AddForm/EnumForms/DeleteForm activity
Workarounds
- Disable the Print Spooler service where printing is not required (Stop-Service Spooler; Set-Service Spooler -StartupType Disabled)
- Restrict printer and form management rights to a minimal set of trusted administrators
Longer-term hardening
- Track MSRC's servicing decision for this report and apply an official fix if one is released
- Deploy EDR with memory-corruption and process-behavior detection covering spoolsv.exe
- Reduce spooler RPC exposure through Print Spooler hardening guidance and attack-surface reduction
- Evaluate print architectures that reduce reliance on the on-host spooler
CVEs associated with Windows Print Spooler Heap Overflow in Form Enumeration
Weaknesses (CWE) in Windows Print Spooler Heap Overflow in Form Enumeration
Timeline of Windows Print Spooler Heap Overflow in Form Enumeration
- PrintNightmare (CVE-2021-1675 / CVE-2021-34527) establishes the Print Spooler's RPC interface as a major attack surface; cited as context only, not stated to be related to this bug.
- Alexandre Borges submits the form-enumeration heap overflow to Microsoft (March 2026; exact day not stated in the article).
- CVE-2026-85877, a separate Windows Print Spooler heap-based buffer overflow record, is published (context; no relationship to this finding is stated).
- Blackstorm Security lists 'Windows: Missing Bounds in the Print Spooler' with a PDF download and video link, describing Segment Heap Variable-Size grooming and function-pointer corruption.
- Article states the bug remains exploitable on current mainstream and Windows Insider Canary builds; no CVE assigned and no patch available.
- The article reports MSRC's October 2026 response that the issue is below the bar for immediate servicing because exploitation requires administrative privileges.
- ER series article 11 is published on exploitreversing.com with the roughly 60-page PDF documenting the four-stage (groom, corrupt, control, execute) exploit.
Sources cited for Windows Print Spooler Heap Overflow in Form Enumeration
- Exploiting Reversing (ER) series: article 11 | Windows: Missing Bounds in the Print Spooler
- Exploit Reversing Article 11 PDF (exploitreversing.com)
- Blackstorm Security Research — Windows: Missing Bounds in the Print Spooler
- Exploit Reversing Article 11 PDF (Blackstorm Security mirror)
- Exploit Reversing Article 11 video
- MS-RPRN: RpcEnumForms (Opnum 34)
- MS-RPRN: 3.1.4.5 Form Management Methods
- EnumForms function (Win32 printdocs)
- AddForm function (Win32 printdocs)
- CVE-2026-85877 — Heap-based buffer overflow in Windows Print Spooler Components (related context, not stated to be the same bug)
- PrintNightmare Vulnerability [CVE-2021-1675 & CVE-2021-34527]
- CWE-122: Heap-based Buffer Overflow
Detection coverage for TL-2026-4578
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4578 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.