CVE-2026-58608 Windows Print Spooler Leading to RCE
Jul 25, 2026
ahmed mokdad
8 min read
❗ CVE-2026-58608 is a Windows Print Spooler Remote Code Execution vulnerability. This flaw has been assigned a CVSSv3 score of 8.8 and affects a wide range of Windows client and server versions. The vulnerability stems from a race condition (CWE-362) and use-after-free (CWE-416) in the Windows Print Spooler Components, allowing an authorized attacker to execute arbitrary code over a network by exploiting improper synchronization of shared resources.
ℹ️ This detection script assesses exposure to CVE-2026-58608 by:
- OS Build Verification: Identifies the running Windows edition, release, and architecture, then compares the full build number against the known vulnerable ranges for that specific product.
- Print Spooler Service Check: Determines whether the
Spoolerservice is running and reports its startup type, since an active spooler is the exposed component. - Remote Printing Configuration Check: Inspects
RegisterSpoolerRemoteRpcEndPointto determine whether the system still accepts inbound remote print client connections. - Comprehensive Status Reporting: Provides a final assessment that correlates the build status with the configuration findings, contextualising any weaknesses against the patch level.
✅ Running this detection script helps evaluate your system’s potential exposure to CVE-2026-58608.
<#
.SYNOPSIS
Detects system exposure to CVE-2026-58608 Windows Print Spooler Remote Code Execution vulnerability.
.DESCRIPTION
Analyzes OS build version, Print Spooler service status, and remote printing configuration
to assess potential exposure to CVE-2026-58608.
REQUIREMENTS:
- PowerShell: 5.1+ or 7.x
- OS: Windows 10/11, Windows Server 2012+
WARNINGS:
- Requires admin privileges for complete assessment.
- Detection focuses on Print Spooler configuration and vulnerable OS builds.
.NOTES
VERSION: 1.0
CHANGELOG:
- 1.0 (2026-7-15): Initial release.
DISCLAIMER:
VICARIUS STRONGLY RECOMMENDS RUNNING THIS SCRIPT IN A TEST LAB ENVIRONMENT
BEFORE DEPLOYING IT TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER
CAREFULLY ANALYZING THE CODE.
.AUTHOR
This script has been made by Vicarius Research Team
.VERSION
1.0
#>
# TAG CONFIGURATION
$TagInfo = "[Info]"
$TagSafe = "[Safe]"
$TagRisk = "[Potential Risk]"
$TagWarn = "[Warning]"
$TagErr = "[Error]"
# Status function
function Write-Status {
param(
[string]$Message,
[ValidateSet("Info","Safe","Risk","Warning","Error")][string]$Level = "Info"
)
$tag = switch ($Level) {
"Info" { $TagInfo }
"Safe" { $TagSafe }
"Risk" { $TagRisk }
"Warning" { $TagWarn }
"Error" { $TagErr }
}
Write-Host "$tag $Message"
}
Write-Status "CVE-2026-58608 Exposure Audit" "Info"
Write-Status "----------------------------------" "Info"
$vulnerabilityFactors = @()
$isVulnerable = $false
# OS Version Detection
try {
$os = Get-CimInstance Win32_OperatingSystem
$name = $os.Caption
$ntCurrentVersion = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ErrorAction Stop
$major = $ntCurrentVersion.CurrentMajorVersionNumber
$minor = $ntCurrentVersion.CurrentMinorVersionNumber
$build = $ntCurrentVersion.CurrentBuildNumber
$ubr = $ntCurrentVersion.UBR
if ($null -eq $major) {
$osVersionParts = ($os.Version -split "\.")
$major = $osVersionParts[0]
$minor = $osVersionParts[1]
}
if ($null -eq $ubr) { $ubr = 0 }
$fullVersion = "$major.$minor.$build.$ubr"
$displayVersion = $ntCurrentVersion.DisplayVersion
if ([string]::IsNullOrEmpty($displayVersion)) { $displayVersion = $ntCurrentVersion.ReleaseId }
$osArch = $os.OSArchitecture
Write-Status "Detected: $name $displayVersion (Build $fullVersion, $osArch)" "Info"
# Mappings for known version labels
$windows10VersionMap = @{
"1607" = "Windows 10 Version 1607"
"1809" = "Windows 10 Version 1809"
"21H2" = "Windows 10 Version 21H2"
"22H2" = "Windows 10 Version 22H2"
}
$windows11VersionMap = @{
"24H2" = "Windows 11 Version 24H2"
"25H2" = "Windows 11 Version 25H2"
"26H1" = "Windows 11 Version 26H1"
}
$osToMatch = $null
$isWindows11 = $name -like "*Windows 11*"
if ($isWindows11) {
if ($windows11VersionMap.ContainsKey($displayVersion)) {
$osToMatch = $windows11VersionMap[$displayVersion]
} else {
$osToMatch = "Windows 11 Version $displayVersion"
}
if ($osArch -like "*ARM64*") {
$osToMatch += " ARM64-based Systems"
} else {
$osToMatch += " x64-based Systems"
}
} elseif ($name -like "*Server*") {
if ($name -like "*Server 2012 R2*") {
$osToMatch = "Windows Server 2012 R2"
if ($name -like "*Core*") {
$osToMatch += " (Server Core installation)"
}
$osToMatch += " x64-based Systems"
} elseif ($name -like "*Server 2012*") {
$osToMatch = "Windows Server 2012"
if ($name -like "*Core*") {
$osToMatch += " (Server Core installation)"
}
$osToMatch += " x64-based Systems"
} elseif ($name -like "*Server 2016*") {
$osToMatch = "Windows Server 2016"
if ($name -like "*Core*") {
$osToMatch += " (Server Core installation)"
}
$osToMatch += " x64-based Systems"
} elseif ($name -like "*Server 2019*") {
$osToMatch = "Windows Server 2019"
if ($name -like "*Core*") {
$osToMatch += " (Server Core installation)"
}
$osToMatch += " x64-based Systems"
} elseif ($name -like "*Server 2022*") {
$osToMatch = "Windows Server 2022 x64-based Systems"
} elseif ($name -like "*Server 2025*") {
$osToMatch = "Windows Server 2025"
if ($name -like "*Core*") {
$osToMatch += " (Server Core installation)"
}
$osToMatch += " x64-based Systems"
} else {
$osToMatch = $name
}
} else {
if ($windows10VersionMap.ContainsKey($displayVersion)) {
$osToMatch = $windows10VersionMap[$displayVersion]
} else {
$osToMatch = "Windows 10 Version $displayVersion"
}
if ($osArch -like "*32*") {
$osToMatch += " 32-bit Systems"
} elseif ($osArch -like "*ARM64*") {
$osToMatch += " ARM64-based Systems"
} else {
$osToMatch += " x64-based Systems"
}
}
Write-Status "OS match key: $osToMatch" "Info"
# Define vulnerable build ranges for CVE-2026-58608
$vulnerableBuilds = @{
"Windows 10 Version 1607 32-bit Systems" = @{ BuildStart = "10.0.14393.0" ; BuildEnd = "10.0.14393.9339" }
"Windows 10 Version 1809 32-bit Systems" = @{ BuildStart = "10.0.17763.0" ; BuildEnd = "10.0.17763.9020" }
"Windows 10 Version 21H2 32-bit Systems" = @{ BuildStart = "10.0.19044.0" ; BuildEnd = "10.0.19044.7548" }
"Windows 10 Version 22H2 32-bit Systems" = @{ BuildStart = "10.0.19045.0" ; BuildEnd = "10.0.19045.7548" }
"Windows 11 Version 24H2 ARM64-based Systems" = @{ BuildStart = "10.0.26100.0" ; BuildEnd = "10.0.26100.8875" }
"Windows 11 Version 25H2 ARM64-based Systems" = @{ BuildStart = "10.0.26200.0" ; BuildEnd = "10.0.26100.8875" }
"Windows 11 Version 26H1 ARM64-based Systems" = @{ BuildStart = "10.0.28000.0" ; BuildEnd = "10.0.28000.2525" }
"Windows Server 2012 (Server Core installation) x64-based Systems" = @{ BuildStart = "6.2.9200.0" ; BuildEnd = "6.2.9200.26226" }
"Windows Server 2012 x64-based Systems" = @{ BuildStart = "6.2.9200.0" ; BuildEnd = "6.2.9200.26226" }
"Windows Server 2012 R2 (Server Core installation) x64-based Systems"= @{ BuildStart = "6.3.9600.0" ; BuildEnd = "6.3.9600.23291" }
"Windows Server 2012 R2 x64-based Systems" = @{ BuildStart = "6.3.9600.0" ; BuildEnd = "6.3.9600.23291" }
"Windows Server 2016 (Server Core installation) x64-based Systems" = @{ BuildStart = "10.0.14393.0" ; BuildEnd = "10.0.14393.9339" }
"Windows Server 2016 x64-based Systems" = @{ BuildStart = "10.0.14393.0" ; BuildEnd = "10.0.14393.9339" }
"Windows Server 2019 (Server Core installation) x64-based Systems" = @{ BuildStart = "10.0.17763.0" ; BuildEnd = "10.0.17763.9020" }
"Windows Server 2019 x64-based Systems" = @{ BuildStart = "10.0.17763.0" ; BuildEnd = "10.0.17763.9020" }
"Windows Server 2022 x64-based Systems" = @{ BuildStart = "10.0.20348.0" ; BuildEnd = "10.0.20348.5386" }
"Windows Server 2025 (Server Core installation) x64-based Systems" = @{ BuildStart = "10.0.26100.0" ; BuildEnd = "10.0.26100.33158" }
"Windows Server 2025 x64-based Systems" = @{ BuildStart = "10.0.26100.0" ; BuildEnd = "10.0.26100.33158" }
}
function Parse-Version { param([string]$v); try { return [Version]$v } catch { return $null } }
$currentVersion = Parse-Version $fullVersion
$patchStatus = ""
if ($vulnerableBuilds.ContainsKey($osToMatch)) {
$vulnStart = Parse-Version $vulnerableBuilds[$osToMatch].BuildStart
$vulnEnd = Parse-Version $vulnerableBuilds[$osToMatch].BuildEnd
if ($currentVersion -ge $vulnStart -and $currentVersion -lt $vulnEnd) {
$isVulnerable = $true
$patchStatus = "Build below patch baseline: $($vulnerableBuilds[$osToMatch].BuildEnd)"
$vulnerabilityFactors += "Vulnerable OS build detected"
} elseif ($currentVersion -ge $vulnEnd) {
$patchStatus = "Build appears to be patched"
} else {
$patchStatus = "Build predates vulnerability range"
}
} else {
$patchStatus = "No matching record in vulnerability database"
}
Write-Host ""
Write-Host "------- Build Assessment -------"
Write-Host ""
if ($isVulnerable) {
Write-Status "This system may be exposed due to a potentially outdated build." "Risk"
Write-Status "For this OS, vulnerable build range: $($vulnerableBuilds[$osToMatch].BuildStart) to $($vulnerableBuilds[$osToMatch].BuildEnd)" "Info"
} else {
Write-Status "System appears to be protected against CVE-2026-58608 at the OS level." "Safe"
if ($vulnerableBuilds.ContainsKey($osToMatch)) {
Write-Status "For this OS, vulnerable build range would be: $($vulnerableBuilds[$osToMatch].BuildStart) to $($vulnerableBuilds[$osToMatch].BuildEnd)" "Info"
}
}
Write-Status "Status: $patchStatus" "Info"
Write-Host ""
} catch {
Write-Status "Unable to evaluate OS version: $($_.Exception.Message)" "Error"
}
# Check Print Spooler Service Status
Write-Host "------- Print Spooler Service Check -------"
Write-Host ""
$spoolerRunning = $false
try {
$spooler = Get-Service -Name "Spooler" -ErrorAction Stop
if ($spooler.Status -eq "Running") {
$spoolerRunning = $true
Write-Status "The Print Spooler service is currently running." "Risk"
Write-Status "An active Print Spooler is the component exposed by CVE-2026-58608." "Risk"
if ($isVulnerable) {
$vulnerabilityFactors += "Print Spooler service is running"
} else {
Write-Status "Note: Print Spooler status is less critical since the OS build appears to be patched." "Info"
}
} else {
Write-Status "The Print Spooler service is not running (Status: $($spooler.Status))." "Safe"
}
Write-Status "Print Spooler startup type: $($spooler.StartType)" "Info"
} catch {
Write-Status "Unable to check Print Spooler service status: $($_.Exception.Message)" "Error"
}
# Check Remote Printing Configuration
Write-Host ""
Write-Host "------- Remote Printing Configuration Check -------"
Write-Host ""
$remotePrintingAllowed = $true
try {
$printersPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers"
$registerSpooler = Get-ItemProperty -Path $printersPolicyPath -Name "RegisterSpoolerRemoteRpcEndPoint" -ErrorAction SilentlyContinue
if ($null -ne $registerSpooler -and $registerSpooler.RegisterSpoolerRemoteRpcEndPoint -eq 2) {
$remotePrintingAllowed = $false
Write-Status "Inbound remote printing is disabled (RegisterSpoolerRemoteRpcEndPoint = 2)." "Safe"
} else {
Write-Status "Inbound remote printing does not appear to be disabled." "Risk"
Write-Status "Accepting remote print client connections may increase the risk of exposure to CVE-2026-58608." "Risk"
if ($isVulnerable) {
$vulnerabilityFactors += "Inbound remote printing is not disabled"
} else {
Write-Status "Note: Remote printing configuration is less critical since the OS build appears to be patched." "Info"
}
}
} catch {
Write-Status "Unable to check remote printing configuration: $($_.Exception.Message)" "Error"
}
# Final Assessment
Write-Host ""
Write-Host "------------- Final Assessment -------------"
Write-Host ""
$mitigationsApplied = $false
if (-not $spoolerRunning -or -not $remotePrintingAllowed) {
$mitigationsApplied = $true
}
if ($isVulnerable) {
if ($vulnerabilityFactors.Count -gt 1) {
Write-Status "ASSESSMENT: This system configuration may increase the risk of exposure to CVE-2026-58608." "Risk"
Write-Status "Risk factors identified:" "Risk"
foreach ($factor in $vulnerabilityFactors) {
Write-Status " - $factor" "Risk"
}
Write-Status "Consider applying mitigations or installing the latest security patches." "Risk"
} elseif ($vulnerabilityFactors.Count -eq 1 -and $mitigationsApplied) {
Write-Status "ASSESSMENT: OS build is within the vulnerable range for CVE-2026-58608, but hardening measures appear to be in place." "Warning"
Write-Status "The Print Spooler is stopped or inbound remote printing is disabled, which may reduce exposure." "Info"
Write-Status "Installing the latest security patches is still recommended for complete protection." "Warning"
} else {
Write-Status "ASSESSMENT: OS build is within the vulnerable range for CVE-2026-58608, but no additional risk factors were identified." "Warning"
Write-Status "Installing the latest security patches is recommended." "Warning"
}
} else {
Write-Status "ASSESSMENT: System appears to be protected against CVE-2026-58608." "Safe"
Write-Status "The OS build is outside the known vulnerable range for this CVE." "Safe"
if ($vulnerabilityFactors.Count -gt 0) {
Write-Status "Note: Some Print Spooler configuration weaknesses were found but are less critical due to the patched OS build." "Info"
}
}
Write-Status "Note: This assessment is based on configuration checks and may not reflect all possible attack vectors." "Info"
if ($isVulnerable -and -not $mitigationsApplied) {
Write-Host "RESULT=CVE-2026-58608|VULNERABLE|TRUE"
} else {
Write-Host "RESULT=CVE-2026-58608|VULNERABLE|FALSE"
}