CVE-2022-38028
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Description
CVE-2022-38028 is a high-severity elevation of privilege vulnerability in the Windows Print Spooler service affecting a wide range of Microsoft Windows operating systems. With a CVSS v3.1 base score of 7.8, this local vulnerability allows an authenticated attacker with low privileges to escalate to SYSTEM-level access through manipulation of the Print Spooler component. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 14, 2024, and its ransomware association is currently classified as unknown. The EPSS score of 4.95% at the 89.5th percentile confirms significant real-world exploitation activity. Affected systems include Windows 10 (multiple versions), Windows 11 22H2, Windows 8.1, Windows RT 8.1, and Windows Server editions from 2012 through 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19507 |
| microsoft | windows 10 1607 | < 10.0.14393.5427 |
| microsoft | windows 10 1809 | < 10.0.17763.3532 |
| microsoft | windows 10 20h2 | < 10.0.19042.2130 |
| microsoft | windows 10 21h1 | < 10.0.19043.2130 |
| microsoft | windows 10 21h2 | < 10.0.19044.2130 |
| microsoft | windows 11 22h2 | < 10.0.22621.674 |
| microsoft | windows 8.1 | < 6.3.9600.20625 |
| microsoft | windows rt 8.1 | < 6.3.9600.20625 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5427 |
| microsoft | windows server 2019 | < 10.0.17763.3532 |
| microsoft | windows server 2022 | < 10.0.20348.1129 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38028(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38028(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-38028 by NVD. However, based on the vulnerability characteristics, this is an elevation of privilege flaw in the Windows Print Spooler service that allows local privilege escalation. The Print Spooler has been a recurring source of critical security vulnerabilities, most notably the PrintNightmare family of bugs (CVE-2021-34527 and related). This vulnerability specifically involves improper handling of privileges within the spooler process, enabling a low-privileged user to execute code in the context of the SYSTEM account. The flaw is related to how the Print Spooler processes certain operations without adequately verifying the caller's privilege level, creating a path from standard user permissions to the highest system privilege.
Impact Analysis
The impact of CVE-2022-38028 centers on complete local system compromise through privilege escalation from a low-privileged user to SYSTEM authority. Confidentiality is fully compromised because SYSTEM-level access grants the attacker unrestricted ability to read any file on the system, access all user credentials stored in memory (via tools like Mimikatz), dump the SAM database and Active Directory secrets on domain controllers, and access encrypted data through the machine's DPAPI master keys.
Integrity faces maximum impact as SYSTEM privileges allow the attacker to modify any file, install persistent backdoors, tamper with security event logs to cover tracks, modify Group Policy Objects on domain controllers, and install rootkits or kernel-mode drivers. The attacker can fundamentally alter the trustworthiness of the entire operating system.
Availability is critically affected because SYSTEM access enables destructive actions including encrypting the file system for ransomware deployment, disabling security services and endpoint protection, corrupting boot records, and rendering the system inoperable. The EPSS score of 4.95% at the 89.5th percentile indicates that this vulnerability is being exploited more actively than roughly 90% of all tracked vulnerabilities. The Print Spooler service runs by default on virtually all Windows installations, and the broad range of affected versions from Windows 8.1 through Windows Server 2022 creates an enormous attack surface across enterprise environments.
Exploit Maturity
CVE-2022-38028 demonstrates high exploit maturity with confirmed active exploitation in the wild. CISA's inclusion in the KEV catalog with a May 14, 2024 remediation deadline confirms that threat actors are actively leveraging this vulnerability. The EPSS score of 4.95% at the 89.5th percentile places this among the top 10% of vulnerabilities in terms of observed exploitation activity.
The Windows Print Spooler has been one of the most heavily targeted Windows components since the disclosure of PrintNightmare in 2021, and security researchers and threat actors have developed deep expertise in exploiting Print Spooler flaws. Microsoft's advisory at MSRC CVE-2022-38028 provides the official vulnerability details and patch information. The local attack vector requires an attacker to have initial code execution on the target system, typically achieved through phishing, drive-by downloads, or lateral movement within a compromised network. Once initial access is obtained, this vulnerability provides a reliable path to SYSTEM-level privileges, making it a valuable component in multi-stage attack chains used by both ransomware operators and advanced persistent threat groups.
Remediation
-
Install the Microsoft security update immediately from the Microsoft Security Response Center. Patches are available for all affected Windows versions including Windows 10 (all supported builds), Windows 11 22H2, Windows 8.1, Windows Server 2012 through 2022. Priority should be given to domain controllers and servers with high-value data.
-
Disable the Print Spooler service on systems that do not require printing functionality as an immediate compensating control. On servers, especially domain controllers, the Print Spooler is often enabled by default but rarely needed. Use Group Policy to disable the service: Computer Configuration > Administrative Templates > Printers > Allow Print Spooler to accept client connections = Disabled.
-
Restrict Print Spooler access via Group Policy on systems where printing is required. Configure the "Point and Print Restrictions" policy to prevent users from installing print drivers without administrator approval, and restrict the Print Spooler to only accept connections from authorized print servers.
-
Monitor for exploitation indicators by enabling detailed logging for Print Spooler activities. Watch for unusual process creation events from spoolsv.exe, unexpected DLL loading by the Print Spooler process, and privilege escalation patterns in Windows Security Event logs (Event IDs 4672 and 4688). Deploy endpoint detection rules specifically targeting Print Spooler exploitation techniques.
-
Audit the patch status across all Windows systems in the environment, including legacy systems running Windows 8.1 and older Server editions. The broad range of affected versions means that overlooked or unmanaged systems can serve as privilege escalation points for attackers who have gained initial network access.
Technical Details
CVE-2022-38028 is an elevation of privilege vulnerability in the Windows Print Spooler, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vector components describe a locally exploitable flaw with straightforward exploitation requirements. Attack Vector (AV:L) indicates the attacker must have local access or the ability to execute code on the target system. Attack Complexity (AC:L) means the exploit works reliably without requiring special conditions or race conditions. Privileges Required (PR:L) confirms that any authenticated user with basic access can exploit the flaw, without needing administrative rights. User Interaction (UI:N) indicates the exploit requires no action from another user. Scope (S:U) means the vulnerability stays within the Print Spooler's security context, though SYSTEM privileges effectively grant unrestricted access.
The Windows Print Spooler (spoolsv.exe) runs as a SYSTEM-level service that manages print jobs and printer driver installations. The vulnerability exists in how the Print Spooler handles specific operations that can be triggered by a low-privileged user, allowing the attacker to execute arbitrary code in the SYSTEM context. The exploitation mechanism is consistent with the broader family of Print Spooler vulnerabilities discovered since 2021, which exploit the service's privileged position and its ability to load and execute code (such as printer drivers) on behalf of requesting users. The affected versions span from Windows 8.1 and Server 2012 through Windows 11 22H2 and Server 2022, indicating a fundamental architectural issue in the Print Spooler's privilege handling that persists across multiple Windows generations.
Frequently Asked Questions
What is CVE-2022-38028?
CVE-2022-38028 is an elevation of privilege vulnerability in the Windows Print Spooler service that allows a low-privileged local attacker to gain SYSTEM-level access. It has a CVSS score of 7.8 and is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active real-world exploitation.
How does this vulnerability relate to PrintNightmare?
While CVE-2022-38028 is a distinct vulnerability with its own patch, it targets the same Windows Print Spooler component that was affected by the PrintNightmare vulnerabilities (CVE-2021-34527 and others). The Print Spooler has been a persistent source of privilege escalation flaws due to its SYSTEM-level execution and complex driver handling capabilities.
Which Windows versions are affected?
The vulnerability affects a broad range of Windows versions including Windows 8.1, Windows 10 (versions 1507 through 22H2), Windows 11 22H2, Windows RT 8.1, and Windows Server 2012 through 2022. Patches are available for all supported versions through Microsoft Update.
Can I mitigate this without patching?
Disabling the Print Spooler service eliminates the attack surface entirely and is recommended for systems that do not need printing functionality, particularly domain controllers and servers. However, patching remains the definitive fix for systems where printing is required.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.