CVE-2026-34342

HighCVSS 7.0/10Last modified Nov 11, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.9140
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8755
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7291
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7417
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.7079
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.7219
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.8457
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.8457
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.2113
MicrosoftWindows Server 2012>= 6.2.9200.0, < 6.2.9200.26079
MicrosoftWindows Server 2012 (Server Core installation)>= 6.2.9200.0, < 6.2.9200.26079
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.23181
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.23181
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.9140
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.9140
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8755
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8755
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5139
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2330
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32860
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32860

References

Timeline

Published
May 12, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-343437.8Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.CVE-2026-343447.8Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attackerCVE-2026-343457.0Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attackerCVE-2026-343465.5Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose iCVE-2026-343477.0Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2026-343486.5Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.CVE-2026-343495.5Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.CVE-2026-343506.5Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network.CVE-2026-343517.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker CVE-2026-343529.8In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicationCVE-2026-343535.1In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is procCVE-2026-343547.4Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA servi
CVE-2026-34342: High severity, CVSS 7.0 | Vulnix