This article has 60 pages, free. A user-mode target this time instead of a kernel one, worked end to end: from a missing bound check to a SYSTEM shell, with the service still running afterwards.
The PDF document is available here:
https://exploitreversing.com/wp-content/uploads/2026/10/exploit_reversing_11.pdf
What it covers:
[+] The bug: a heap overflow (CWE-122) in the Print Spooler’s form-enumeration path, reached
through InternalEnumForms → CopyIniFormToFormInfo → PackStrings → memcpy.
[+] It is still unpatched. I submitted it to Microsoft in March 2026 and MSRC assessed it as below the bar for
immediate servicing, because the PoC requires administrative rights. Re-confirmed working in October against current mainstream and Canary builds.
[+] The exploitation, which is two thirds of the article, with four stages: groom, corrupt, control, execute. The process never crashes: spoolsv.exe is left running and the planted form deleted.
[+] Important note: I had already notified the MSRC months ago that I would write an article about the vulnerability and publish it.
I would like to thank Ilfak Guilfanov (@ilfak on X) and Hex-Rays SA (@HexRaysSA on X) for the continuous support.
This article is also available on https://www.blackstormsecurity.com/research/, which is the primary source for articles.
Hope you enjoy the read!
Alexandre Borges
(October 27, 2026)
