# Windows Print Spooler Heap Overflow in Form Enumeration (InternalEnumForms/CopyIniFormToFormInfo/PackStrings memcpy) — Unpatched, Public 60-Page Exploit Write-Up

> Security researcher Alexandre Borges published a 60-page write-up and working exploit for an unpatched heap overflow (CWE-122) in the Windows Print Spooler (spoolsv.exe) form-enumeration path InternalEnumForms -> CopyIniFormToFormInfo -> PackStrings -> memcpy. The bug was submitted to Microsoft in March 2026; MSRC judged it below the bar for immediate servicing because triggering it requires administrative privileges, and it remains exploitable on current mainstream and Canary builds as of October 2026.

- **Published:** 2026-10-27T23:06:27Z
- **Last reviewed:** 2026-10-27T23:06:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4578
- **ID:** TL-2026-4578
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85877, CVE-2021-1675, CVE-2021-34527

## Description

Article 11 of Alexandre Borges' 'Exploiting Reversing' (ER) series, titled 'Windows: Missing Bounds in the Print Spooler', documents a heap overflow (CWE-122) in the user-mode Windows Print Spooler service, spoolsv.exe. The vulnerable path is the form-enumeration code: InternalEnumForms calls CopyIniFormToFormInfo, which calls PackStrings, whose memcpy writes beyond the intended bounds of the heap buffer. The title of the article refers to this as 'missing bounds'.

The accompanying PDF (about 60 pages) describes the exploitation in four stages: groom, corrupt, control and execute. Per the Blackstorm Security research listing, the exploit grooms the Windows Segment Heap's Variable-Size allocator and then corrupts function pointers to achieve code execution inside spoolsv.exe. The author states that after exploitation the spooler service keeps running without crashing and the planted form used to trigger the bug is deleted afterward, which reduces the observable footprint (no service crash, no lingering form entry).

Microsoft was informed in March 2026. According to the article, MSRC responded in October 2026 that the report falls below the bar for immediate servicing because exploitation requires administrative privileges. The article states the issue is still reproducible as of October 2026 on current mainstream Windows builds and on Windows Insider Canary builds. No CVE identifier and no CVSS score has been published, and the sources do not describe in-the-wild exploitation, a threat actor, or network or malware IOCs. This is public vulnerability research with an exploit write-up and a video, not an observed campaign.

Operational significance: because spoolsv.exe runs as LocalSystem (standard Windows behavior), a successful exploit would turn administrator-level access into SYSTEM-level code execution inside a trusted signed service, which matters mainly for environments that treat local administrator accounts as a security boundary (tiered administration, PAWs, delegated admin). The Print Spooler's RPC-exposed form-management interface (MS-RPRN: RpcAddForm, RpcEnumForms Opnum 34, RpcSetForm, RpcDeleteForm; Win32 AddForm/EnumForms) is a long-standing attack surface — see PrintNightmare (CVE-2021-1675 / CVE-2021-34527) and the recent Print Spooler heap-overflow record CVE-2026-85877. The article does not state any relationship between this bug and those CVEs, and none is asserted here. Borges credits Ilfak Guilfanov and Hex-Rays SA for support, consistent with IDA Pro being used for reverse engineering. The function-level details beyond those named in the article's summary could not be extracted from the PDF by this analysis (binary PDF not machine-readable in this environment) and are therefore not stated.

## MITRE ATT&CK

- T1106 Native API
- T1587.004 Exploits
- T1078.003 Local Accounts

## Sources

- [Exploiting Reversing (ER) series: article 11 | Windows: Missing Bounds in the Print Spooler](https://exploitreversing.com/2026/10/27/exploiting-reversing-er-series-article-11/)
- [Exploit Reversing Article 11 PDF (exploitreversing.com)](https://exploitreversing.com/wp-content/uploads/2026/10/exploit_reversing_11.pdf)
- [Blackstorm Security Research — Windows: Missing Bounds in the Print Spooler](https://www.blackstormsecurity.com/research/)
- [Exploit Reversing Article 11 PDF (Blackstorm Security mirror)](https://blackstormsecurity.com/research/exploit_reversing_11.pdf)
- [Exploit Reversing Article 11 video](https://youtu.be/-jvsxLq90zQ)
- [MS-RPRN: RpcEnumForms (Opnum 34)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/0b9dde14-73d1-4f1a-9f74-8e82255a9612)
- [MS-RPRN: 3.1.4.5 Form Management Methods](https://msdn.microsoft.com/en-us/library/cc244626)
- [EnumForms function (Win32 printdocs)](https://learn.microsoft.com/en-us/windows/win32/printdocs/enumforms)
- [AddForm function (Win32 printdocs)](https://learn.microsoft.com/en-us/windows/win32/printdocs/addform)
- [CVE-2026-85877 — Heap-based buffer overflow in Windows Print Spooler Components (related context, not stated to be the same bug)](https://app.opencve.io/cve/CVE-2026-85877)
- [PrintNightmare Vulnerability CVE-2021-1675 & CVE-2021-34527](https://safe.security/resources/reports-research/printnightmare-vulnerability/)
- [CWE-122: Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4578