CVE-2023-24913
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems using Microsoft PostScript and PCL6 Class Printer Drivers. Attackers can exploit this by sending specially crafted print jobs to vulnerable systems. Affected systems include Windows servers and workstations with these printer drivers installed.
💻 Affected Systems
- Microsoft PostScript Printer Driver
- Microsoft PCL6 Class Printer Driver
📦 What is this software?
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Privilege escalation leading to lateral movement within networks, particularly in enterprise environments with shared printers.
If Mitigated
Limited impact with proper network segmentation and printer server isolation, potentially only affecting the print spooler service.
🎯 Exploit Status
Exploitation requires sending malicious print jobs to vulnerable systems. No authentication is required if print services are exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security updates released in May 2023 (KB5026372 for Windows 10, KB5026371 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24913
Restart Required: Yes
Instructions:
1. Apply May 2023 security updates from Windows Update. 2. For enterprise environments, deploy updates via WSUS or SCCM. 3. Restart systems after patch installation.
🔧 Temporary Workarounds
Disable Print Spooler Service
windowsDisables the Print Spooler service to prevent exploitation via print jobs.
sc config spooler start= disabled
sc stop spooler
Restrict Printer Sharing
windowsDisable printer sharing to prevent remote print job submission.
Set-Printer -Name "*" -Shared $false
🧯 If You Can't Patch
- Network segmentation: Isolate print servers from critical systems and restrict access to print services.
- Implement strict firewall rules: Block inbound connections to print spooler ports (TCP 9100, 515, 631) from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check if May 2023 security updates are installed via 'wmic qfe list' or 'Get-HotFix' in PowerShell.Check Version:
wmic qfe list | findstr KB5026372Verify Fix Applied:
Verify security update KB5026372 (or equivalent for your OS) is installed and Print Spooler service is running version 10.0.xxxxx.xxxx or later.📡 Detection & Monitoring
Log Indicators:
- Event ID 4625 failed logins to print spooler
- Unusual print job submissions from unexpected sources
- Spooler service crashes (Event ID 7031)
Network Indicators:
- Unexpected connections to TCP ports 9100, 515, 631
- Malformed print job packets to print servers
SIEM Query:
source="windows" event_id=4625 OR event_id=7031 | where process_name="spoolsv.exe"