CVE-2021-1675: Windows Print Spooler Remote Code Execution Vulnerability

Overview

Severity: High (CVSS 7.8)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category: Remote Code Execution
Exploit Status: Not Exploited
Exploitation Likelihood: Less Likely
Patch Tuesday: 2021-Jun
Released: 2021-06-08
Last Updated: 2021-07-02
EPSS Score: 94.31% (percentile: 100.0%)
CISA KEV: Listed — due 2021-11-17

FAQ

Is this the vulnerability that has been referred to publicly as PrintNightmare? No, Microsoft has assigned CVE-2021-34527 to PrintNightmare. CVE-2021-1675 is similar but distinct from CVE-2021-34527.

Known Exploits (34)

Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2025-11-19T09:49:52Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2025-07-29T20:33:23Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2024-06-05T10:01:18Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2024-02-12T20:59:08Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2024-02-12T20:54:51Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2023-05-30T09:21:44Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2023-02-20T19:58:37+08:00
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2022-04-14T08:21:10Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2022-02-22T03:32:34Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2022-02-22T03:32:14Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2022-01-30T04:47:44Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2022-01-15T11:46:41Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-12-05T14:49:32Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-12-01T12:30:12+08:00
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-10-05T19:24:23Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-09-27T14:59:20+08:00
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-09-27T14:59:19+08:00
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-09-26T20:46:23Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-09-26T13:53:10Z
Microsoft Windows Print Spooler Remote Code Execution Vulnerability — added 2021-09-01T11:25:04Z

Detection & Weaponization (3 sources)

Maturity: Detection

Metasploit modules: Print Spooler Remote DLL Injection
Sigma rules: Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection, Potential PrintNightmare Exploitation Attempt, CVE-2021-1675 Print Spooler Exploitation Filename Pattern, Windows Spooler Service Suspicious Binary Load, PrinterNightmare Mimikatz Driver Name, Possible CVE-2021-1675 Print Spooler Exploitation, CVE-2021-1675 Print Spooler Exploitation, CVE-2021-1675 Print Spooler Exploitation IPC Access, Possible PrintNightmare Print Driver Install - CVE-2021-1675
GitHub PoC: 45 repositories

Affected Products (39)

Windows

Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 2004 for 32-bit Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 2004 for x64-based Systems
Windows Server, version 2004 (Server Core installation)
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server, version 20H2 (Server Core Installation)
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1

ESU

Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

Security Updates (13)

Acknowledgments

Yunhai Zhang of NSFOCUS TIANJI LAB https://www.nsfocus.com.cn/, <a href="https://www.linkedin.com/in/piotr-madej-18b0bb38/">Piotr Madej of AFINE</a>, <a href="">Zhipeng Huo (@R3dF09) </a> of <a href="https://xlab.tencent.com">Tencent Security Xuanwu Lab </a>

Revision History

2021-06-08: Information published.
2021-06-21: Corrected the CVE title to address the vulnerability as remote code execution. In the Affected Products table, corrected the Impact to Remote Code Execution and the Severity to Critical. This is an informational change only.
2021-07-02: Added FAQ information. This is an informational change only.