Benjamin Delpy

**Name of the Vulnerable Software and Affected Versions** Windows Print Spooler (affected versions not specified) **Description** A remote code execution issue exists due to the Windows Print Spooler service improperly performing privileged file operations. This allows an attacker to run arbitrary code with SYSTEM privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited by sending a specially crafted request, potentially allowing attackers to execute arbitrary code and affect the system. **Recommendations** To prevent exploitation, stop and disable the Print Spooler service. As a temporary workaround, consider disabling the Print Spooler service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions 10 v1809 and later **Description** An elevation of privilege issue exists due to overly permissive Access Control Lists (ACLs) on multiple system files located in the `%windir%system32config` directory, specifically the Security Accounts Manager (SAM), SYSTEM, and SECURITY registry hive files. A local attacker with the ability to execute code on the system can access these files through Volume Shadow Copies to extract hashed passwords, DPAPI encryption keys, and computer account details used for Active Directory joins. This allows the attacker to crack hashes offline and subsequently run arbitrary code with SYSTEM privileges, enabling them to install programs, modify data, or create new accounts with full administrative rights. **Recommendations** For Microsoft Windows versions 10 v1809 and later, install the provided security update and manually delete all volume shadow copies of system files, including the SAM database. Restrict access to the contents of the `%windir%system32config` directory to minimize the risk of exploitation.