CyberGlossary

Vulnerabilities

PrintNightmare (CVE-2021-34527)

Also known as: CVE-2021-34527, Spoolsv RCE

Definition

A 2021 Windows Print Spooler vulnerability that let a low-privileged user install a malicious print driver and execute code with SYSTEM privileges.

PrintNightmare (CVE-2021-34527, with the related CVE-2021-1675) is a flaw in the Windows Print Spooler service that did not properly validate AddPrinterDriverEx calls. By pointing the spooler at a malicious DLL via a network share, a domain user — and remotely, in some configurations, an unauthenticated attacker — could load that DLL and execute arbitrary code as SYSTEM, including on domain controllers. Disclosed accidentally in July 2021, it was rapidly weaponised by ransomware actors. Microsoft issued out-of-band patches and registry hardening guidance. Defences: apply all PrintNightmare-related patches, disable the Print Spooler on servers that do not need it (especially domain controllers), and restrict point-and-print to administrators.

Examples

  • Ransomware groups abusing PrintNightmare to elevate to SYSTEM and deploy payloads on domain controllers.
  • Red-team operators using PrintNightmare to escalate from a standard domain user to local admin.

Related terms