CVE-2026-58608

Windows’ Print Spooler is the background service that manages printing tasks. This vulnerability is like a timing bug in how it shares and coordinates work: under certain conditions, an attacker can force it to do something it shouldn’t, including running their own code. Because it works over the network and doesn’t require a user to click anything, it’s especially important to keep printing-related systems up to date.

This matters if you run Windows 10, Windows 11, or Windows Server (2012–2025) machines with the Print Spooler enabled/used, especially if those machines are reachable by other devices on your network or by administrators. The risk is not just “internet-exposed”—the flaw requires an attacker with authorized access to the print spooler system (described as low), and it is reachable via the network.

In practice: prioritize systems where an attacker could already gain low-level access or reach printer services on the host.

This is RED because it’s a remote code execution flaw in a core Windows printing component, and attackers can trigger it over the network without any user interaction. Even though CISA KEV does not list this CVE, the existence of a race-condition RCE with available fixed builds means you should treat it as an urgent patching item for any machine with Print Spooler enabled.