PrintNightmare

security

A 2021 set of flaws in the Windows Print Spooler enabling remote code execution.

PrintNightmare abused the Print Spooler service, which runs with high privileges and is enabled by default, to run attacker code and escalate to system. It led to emergency patches and guidance to disable the spooler where not needed.

PrintNightmare was a series of vulnerabilities in the Windows Print Spooler allowing privilege escalation and remote code execution. It became notorious partly because the disclosure was accidental, with proof-of-concept code published before the fix was ready, and partly because the initial patches were incomplete.

The underlying problem is architectural and older than the bugs. The spooler runs with high privilege, is enabled by default on virtually every Windows system including domain controllers, and accepts driver installation from remote sources by design, because that is how network printing was supposed to work. Printing was designed in an era with different assumptions about who is on your network.

The advice that emerged was blunt and correct: disable the spooler on machines that do not print, particularly domain controllers. That is a good illustration of attack surface reduction beating patching as a strategy, because the vulnerability class kept producing new instances while a disabled service produced none. It also illustrates that default-enabled legacy services are a category of risk that patching never resolves, since the next one in the same component is already being written.

Also known as: PrintNightmare, CVE-2021-34527

← All glossary entries