CVE-2026-70147 – Microsoft PostScript Printer Driver Remote Code Execution Vulnerability

Microsoft has identified a critical Remote Code Execution (RCE) vulnerability in the Microsoft PostScript Printer Driver. This security flaw allows an unauthenticated attacker to execute malicious code remotely by sending a specially crafted print job to an affected print service over the network. The vulnerability results from a heap-based buffer overflow and requires neither user interaction nor authentication. With a CVSS score of 9.8, successful exploitation could compromise sensitive information, allow unauthorized system modifications, and disrupt essential business operations. Although exploitation is currently considered less likely, the vulnerability presents a serious security risk because of its low attack complexity and widespread impact across Windows operating systems and servers.

CVSS SCORE: 9.8

SEVERITY: Critical

Threat

This vulnerability presents a critical security threat because attackers can potentially compromise affected systems remotely without requiring valid credentials or user interaction.

The vulnerability has several dangerous characteristics:

• Network-based attack: Attackers can target vulnerable print services over a network.
• No authentication required: Attackers do not need an existing account or elevated privileges.
• No user interaction: Exploitation does not require users to open files, click links, or approve requests.
• Low attack complexity: The vulnerability does not require complex conditions to exploit.
• Complete security impact: Successful exploitation could severely affect system confidentiality, integrity, and availability.

Organizations operating vulnerable Windows print services could face unauthorized access, system compromise, and significant operational disruption.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

The vulnerability is not publicly disclosed, and there are no reported instances of active exploitation.

The exploit code maturity is classified as Unproven, meaning reliable exploit code has not been established.

The information does not confirm the existence of publicly available proof-of-concept (PoC) exploit code.

Although there is no confirmed active exploitation or zero-day activity, the vulnerability remains dangerous because attackers could potentially exploit it remotely without authentication.

Technical Summary

CVE-2026-70147 is a critical heap-based buffer overflow vulnerability (CWE-122) affecting the Microsoft PostScript Printer Driver.

The vulnerability occurs when the affected printer driver processes specially crafted print jobs, potentially causing memory corruption.

A heap-based buffer overflow happens when an application writes more data into a dynamically allocated memory buffer than it can safely accommodate. This can corrupt nearby memory locations and potentially allow attackers to execute malicious instructions.

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted print job to an affected print service over the network.

Because the attack vector is network-based and the attack complexity is low, exploitation does not require physical access to the target computer.

Successful exploitation could allow an attacker to:

• Execute unauthorized code on the affected system.
• Access or compromise sensitive information.
• Modify system configurations or critical files.
• Disrupt printing services and other business operations.
• Compromise the confidentiality, integrity, and availability of the affected system.

The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting its potentially severe security consequences.

Microsoft has released an official security fix to address this vulnerability.

Exploitability

The vulnerability affects multiple Microsoft products, including:

• Windows 10: Versions 1607, 1809, 21H2, and 22H2.
• Windows 11: Versions 23H2, 24H2, 25H2, and 26H1.
• Windows Server: 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations.
• Microsoft Visual Studio: 2026 version 18.10.

Affected Windows editions include the listed 32-bit, x64, and ARM64 configurations, depending on the operating system version.

An attacker could exploit the vulnerability by sending a specially crafted print job to an affected print service over the network.

No authentication, elevated privileges, or user interaction is required.

Microsoft currently assesses exploitation as less likely.

Business Impact

This vulnerability poses a significant business risk because it could allow attackers to compromise vulnerable systems remotely without requiring employee interaction.

Organizations relying on Windows-based print services, shared printing infrastructure, and affected Windows servers may face serious security and operational consequences.

Potential business impacts include:

• Unauthorized system access: Attackers could execute malicious code and potentially gain control of compromised systems.
• Sensitive data exposure: Confidential business information, customer records, and internal documents could be exposed.
• Operational disruption: Compromised print services or Windows systems could interrupt important business activities.
• Malware deployment: Attackers could potentially use a compromised system to introduce additional malicious software.
• Financial losses: Incident response, recovery operations, and business downtime could generate substantial costs.
• Reputational damage: Security incidents involving sensitive information could weaken customer confidence and business relationships.

The risk is particularly important for organizations operating shared print services across large corporate networks.

A printer service should never become an open door into an organization’s critical systems. Yet this vulnerability could turn a routine print request into a serious security incident.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Organizations unable to deploy the security update immediately should consider temporarily restricting network access to affected print services or disabling unnecessary printing functionality where operationally feasible.

These measures are precautionary and are not confirmed fixes for the vulnerability.

Installing the appropriate Microsoft security update remains the recommended remediation.

Urgency

Critical – Prioritize deployment of the security update.

CVE-2026-70147 requires urgent patching because it combines a CVSS score of 9.8, remote code execution capabilities, low attack complexity, and no authentication or user interaction requirements.

Although Microsoft currently considers exploitation less likely and no active exploitation has been reported, the potential consequences of a successful attack are severe.

Organizations should prioritize patch deployment on systems running affected Windows versions, particularly servers hosting print services and systems accessible across business networks.

Relevant security updates include KB5126868, KB5126651, KB5126657, KB5126653, KB5127648, KB5127646, KB5126835, KB5126836, KB5126655, and KB5126646, depending on the affected product.

A system restart is required after installing the applicable security update.

Given the vulnerability’s critical severity and potential for unauthenticated remote code execution, organizations should deploy the appropriate updates as soon as operationally possible.