Loading story…
Microsoft disclosed two remote code execution vulnerabilities in the Windows Line Printer Daemon (LPD) Service, tracked as CVE-2024-38199 and CVE-2025-21224, through its Security Update Guide. Both advisories identify the same Windows printing-related network service as the affected component, indicating repeated security exposure in software that can be reachable over the network in environments where LPD is enabled.
The disclosures show that organizations running Windows systems with the LPD Service enabled should review Microsoft’s updates for both CVEs and assess whether the legacy print protocol is necessary in their environment. Because the flaws allow remote code execution, affected hosts could face compromise if the service is exposed to untrusted networks, making patching, service hardening, and disabling unused LPD functionality key defensive actions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2025-21224 in its Security Update Guide, identifying another remote code execution vulnerability in the Windows Line Printer Daemon (LPD) Service.
Microsoft added CVE-2024-38199 to its Security Update Guide as a remote code execution vulnerability affecting the Windows Line Printer Daemon (LPD) Service.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a series of **Windows PrintWorkflowUserSvc Elevation of Privilege** vulnerabilities affecting the Windows printing workflow service. The issues were assigned multiple CVEs, including `CVE-2024-49095`, `CVE-2025-21235`, `CVE-2025-55331`, `CVE-2025-55684`, `CVE-2025-55685`, `CVE-2025-55686`, `CVE-2025-55688`, `CVE-2025-55689`, and `CVE-2025-55691`, indicating repeated security weaknesses in the same Windows component. The advisories provide limited public detail, but each entry classifies the issue as an **elevation of privilege** flaw in `PrintWorkflowUserSvc`, a service tied to Windows print processing. For defenders, the cluster signals that organizations running Windows endpoints and print-enabled systems should prioritize Microsoft security updates covering this service, review exposure across workstation and server fleets, and monitor for post-compromise activity that could indicate local privilege escalation through the printing stack.
Jul 12, 2026
Microsoft published security advisories for several remote code execution vulnerabilities affecting core Windows networking and productivity components, including **Layer 2 Tunneling Protocol (L2TP)** flaws tracked as `CVE-2023-41765`, `CVE-2023-41770`, and `CVE-2023-41773`, a **Windows Remote Desktop Services** issue tracked as `CVE-2025-21297`, and a **Microsoft Office** vulnerability tracked as `CVE-2026-40358`. The advisories indicate that the affected attack surfaces span remote access, tunneling, and document-handling functionality, increasing the importance of patching internet-exposed and user-facing systems.
Jul 12, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026