Loading story…
Microsoft published security advisories for a series of Windows PrintWorkflowUserSvc Elevation of Privilege vulnerabilities affecting the Windows printing workflow service. The issues were assigned multiple CVEs, including CVE-2024-49095, CVE-2025-21235, CVE-2025-55331, CVE-2025-55684, CVE-2025-55685, CVE-2025-55686, CVE-2025-55688, CVE-2025-55689, and CVE-2025-55691, indicating repeated security weaknesses in the same Windows component.
The advisories provide limited public detail, but each entry classifies the issue as an elevation of privilege flaw in PrintWorkflowUserSvc, a service tied to Windows print processing. For defenders, the cluster signals that organizations running Windows endpoints and print-enabled systems should prioritize Microsoft security updates covering this service, review exposure across workstation and server fleets, and monitor for post-compromise activity that could indicate local privilege escalation through the printing stack.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released Security Update Guide entries for CVE-2025-55331, CVE-2025-55684, CVE-2025-55685, CVE-2025-55686, CVE-2025-55688, CVE-2025-55689, and CVE-2025-55691, all described as Windows PrintWorkflowUserSvc elevation of privilege vulnerabilities. These entries represent a coordinated batch disclosure of multiple distinct flaws in the same Windows service.
Microsoft published a Security Update Guide entry for CVE-2025-21235, another elevation of privilege vulnerability affecting Windows PrintWorkflowUserSvc. The advisory marks a new distinct vulnerability disclosure in the same component.
Microsoft published a Security Update Guide entry for CVE-2024-49095, an elevation of privilege vulnerability in Windows PrintWorkflowUserSvc. This indicates the vulnerability was publicly disclosed and tracked by Microsoft on that date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation of privilege vulnerabilities affecting core platform components, including **Windows App Package Installer**, **Windows Installer**, and **Windows Authentication**. The referenced issues are tracked as `CVE-2025-21275`, `CVE-2025-33075`, `CVE-2025-32714`, and `CVE-2025-55701`, indicating that attackers who already have some level of access could potentially exploit weaknesses in trusted Windows services to gain higher privileges on affected systems. The vulnerabilities span software installation and authentication mechanisms that are widely present in enterprise environments, increasing their relevance for defenders managing Windows fleets. Organizations should prioritize applying Microsoft security updates for affected systems and review exposure across endpoints and servers where installer workflows or Windows authentication components are in use, as elevation of privilege flaws can be chained with other compromises to expand attacker control.
Jul 12, 2026
Microsoft published Security Update Guide entries for multiple Windows vulnerabilities, including **`CVE-2022-21895`**, identified as a **Windows User Profile Service Elevation of Privilege Vulnerability**, alongside newer advisories for **`CVE-2024-29057`** and **`CVE-2024-38140`**. The references indicate a set of Microsoft-tracked security issues affecting Windows components and documented through the Microsoft Security Response Center (MSRC). The available details are limited in the referenced advisories, but the common thread is Microsoft's disclosure and tracking of vulnerabilities that could enable **elevation of privilege** or otherwise require security updates through the Windows patching process. Organizations relying on Windows systems should review the corresponding MSRC entries, determine affected products and versions, and prioritize remediation based on exposure and the role of the impacted systems.
Jul 12, 2026
Microsoft disclosed two **remote code execution** vulnerabilities in the Windows **Line Printer Daemon (LPD) Service**, tracked as `CVE-2024-38199` and `CVE-2025-21224`, through its Security Update Guide. Both advisories identify the same Windows printing-related network service as the affected component, indicating repeated security exposure in software that can be reachable over the network in environments where LPD is enabled. The disclosures show that organizations running Windows systems with the **LPD Service** enabled should review Microsoft’s updates for both CVEs and assess whether the legacy print protocol is necessary in their environment. Because the flaws allow **remote code execution**, affected hosts could face compromise if the service is exposed to untrusted networks, making patching, service hardening, and disabling unused LPD functionality key defensive actions.
Jul 12, 2026