Advisory · CVE-2026-70153
Second heap overflow in Microsoft PostScript Printer Driver, also 9.8
The Microsoft PostScript Printer Driver has a second heap-based buffer overflow in the same month's updates, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.
- Vendor
- Microsoft
- Product
- Microsoft PostScript Printer Driver
- Identifier / CWE
- CVE-2026-70153
CWE-122 - Action timing
- Immediate
Explain it like I’m five
Two different cracks in the same driver: either one lets network input overflow memory in a component that runs with high privilege.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Microsoft PostScript Printer Driver.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-70153 in its October 2026 update guide as a distinct heap-based buffer overflow (CWE-122) in the Microsoft PostScript Printer Driver, alongside CVE-2026-70147 in the same component.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft PostScript Printer Driver deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft PostScript Printer Driver while remediation is underway, especially for internet-facing instances.
- Review application and server logs for spooler instability and print jobs with malformed PostScript content.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
One patch cycle closes both driver flaws. Print servers and shared-print hosts should not be the machines that wait until next month.