What’s Vulnerable › Vulnerabilities

CVE-2021-36958: Windows Print Spooler Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 30.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-12 · updated 2026-08-10

Description

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Affected products

• Microsoft Corporation Windows: all versions
• Microsoft Windows 10 Version 1507: from 10.0.10240.0 before 10.0.10240.19060 — fixed in 10.0.10240.19060
• Microsoft Windows 10 1607: from 10.0.14393.0 before 10.0.14393.4651 — fixed in 10.0.14393.4651
• Microsoft Windows 10: from 10.0.17763.0 before 10.0.17763.2183 — fixed in 10.0.17763.2183
• Microsoft Windows 10 1909: from 10.0.0 before 10.0.18363.1801 — fixed in 10.0.18363.1801
• Microsoft Windows 10 2004: from 10.0.0 before 10.0.19041.1237 — fixed in 10.0.19041.1237
• Microsoft Windows 10 20H2: from 10.0.0 before 10.0.19042.1237 — fixed in 10.0.19042.1237
• Microsoft Windows 10 21H1: from 10.0.0 before 10.0.19043.1237 — fixed in 10.0.19043.1237
• Microsoft Windows 7: from 6.1.0 before 6.1.7601.25712 — fixed in 6.1.7601.25712
• Microsoft Windows 7 Service Pack 1: from 6.1.0 before 6.1.7601.25712 — fixed in 6.1.7601.25712
• Microsoft Windows 8.1: from 6.3.0 before 6.3.9600.20120 — fixed in 6.3.9600.20120
• Microsoft Windows Server 2008 R2 Service Pack 1: from 6.1.7601.0 before 6.1.7601.25712 — fixed in 6.1.7601.25712
• Microsoft Windows Server 2008 Service Pack 2: from 6.0.6003.0 before 6.0.6003.21218 — fixed in 6.0.6003.21218
• Microsoft Windows Server 2012: from 6.2.9200.0 before 6.2.9200.23462 — fixed in 6.2.9200.23462
• Microsoft Windows Server 2012 R2: from 6.3.9600.0 before 6.3.9600.20120 — fixed in 6.3.9600.20120
• Microsoft Windows Server 2016: from 10.0.14393.0 before 10.0.14393.4651 — fixed in 10.0.14393.4651
• Microsoft Windows Server 2019: from 10.0.17763.0 before 10.0.17763.2183 — fixed in 10.0.17763.2183
• Microsoft Windows Server version 2004: from 10.0.0 before 10.0.19041.1237 — fixed in 10.0.19041.1237
• Microsoft Windows Server version 20H2: from 10.0.0 before 10.0.19042.1237 — fixed in 10.0.19042.1237

How to fix

Upgrade to a fixed version: Microsoft Windows 10 Version 1507 10.0.10240.19060; Microsoft Windows 10 1607 10.0.14393.4651; Microsoft Windows 10 10.0.17763.2183; Microsoft Windows 10 1909 10.0.18363.1801; Microsoft Windows 10 2004 10.0.19041.1237; Microsoft Windows 10 20H2 10.0.19042.1237; Microsoft Windows 10 21H1 10.0.19043.1237; Microsoft Windows 7 6.1.7601.25712; Microsoft Windows 7 Service Pack 1 6.1.7601.25712; Microsoft Windows 8.1 6.3.9600.20120; Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.25712; Microsoft Windows Server 2008 Service Pack 2 6.0.6003.21218. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36958
• https://www.kb.cert.org/vuls/id/131152

Get alerted when CVE-2021-36958 or the next vulnerability affects your stack