CVE-2026-62712: Windows UMPDDrvRealizeBrush Local Privilege Escalation — Detection and Remediation Guide

---
title: Suspicious Child Process Spawned by Print Isolation Host
id: 8c2a1f47-3b6e-4d91-a5c2-7e9f0b1d3a55
status: experimental
description: Detects PrintIsolationHost.exe spawning command shells, script engines, or other executables. PrintIsolationHost is the UMPD driver host and should never spawn interactive child processes; this is a strong indicator of printer-driver-path exploitation such as CVE-2026-62712.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-621/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\PrintIsolationHost.exe'
  selection_children:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_children
falsepositives:
  - Rare. Legitimate print isolation hosts do not spawn interactive shells or admin tooling.
level: high
---
title: Non-System Parent Spawning Process Running as SYSTEM
id: 4f7b9e12-6c3a-4d82-b9e1-2a5c8d0f6b77
status: experimental
description: Detects a SYSTEM-privileged process whose parent is a non-elevated user process, consistent with token-theft privilege escalation from object-management bugs such as CVE-2026-62712 in the UMPD/GDI stack.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-621/
  - https://attack.mitre.org/techniques/T1134/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.privilege_escalation
  - attack.t1134
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User: 'NT AUTHORITY\SYSTEM'
  selection_shells:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_known_parents:
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
      - '\wininit.exe'
      - '\smss.exe'
      - '\MsMpEng.exe'
      - '\SgrmBroker.exe'
      - '\msiexec.exe'
      - '\TiWorker.exe'
      - '\wmiprvse.exe'
      - '\taskhostw.exe'
      - '\spoolsv.exe'
  condition: selection_user and selection_shells and not filter_known_parents
falsepositives:
  - Software deployment agents or management tools spawning interactive SYSTEM shells. Tune ParentImage filters per your management stack (SCCM, Intune, RMM).
level: high
---
title: Unusual GDI/Print API Churn from Suspicious User Processes
id: 1d9e5a38-2f47-4b60-8c13-9e4a7d2c5f66
status: experimental
description: Detects unsigned or temp-directory executables loading printer and GDI-related modules, consistent with LPE tooling that drives the UMPD callback path used by CVE-2026-62712.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-621/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: image_load
  product: windows
detection:
  selection_dlls:
    ImageLoaded|endswith:
      - '\winspool.drv'
      - '\umpdmgr.dll'
  selection_suspicious_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  condition: selection_dlls and selection_suspicious_path
falsepositives:
  - Legitimate printing from user-context applications (e.g., browsers printing documents). Correlate with unsigned binaries and non-standard app paths.
level: medium

// Hunt for UMPD/GDI LPE indicators (CVE-2026-62712): anomalous process trees involving
// PrintIsolationHost and SYSTEM-context shells spawned by non-system parents.
let Lookback = 14d;
let SystemParents = dynamic(["services.exe", "svchost.exe", "wininit.exe", "smss.exe", "msiexec.exe", "TiWorker.exe", "wmiprvse.exe", "taskhostw.exe", "spoolsv.exe", "MsMpEng.exe"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "PrintIsolationHost.exe"
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "net.exe", "whoami.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256 = SHA256, ReportId
    | extend Indicator = "PrintIsolationHost spawned child process"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where AccountName =~ "SYSTEM"
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
    | where not(InitiatingProcessFileName in~ (SystemParents))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256, ReportId
    | extend Indicator = "SYSTEM shell from non-system parent"
)
| sort by TimeGenerated desc

-- Triage: find SYSTEM-context interactive shells and anomalous PrintIsolationHost instances
-- relevant to UMPD/GDI privilege escalation (CVE-2026-62712 / ZDI-26-621)
SELECT Pid,
       Ppid,
       Name,
       CommandLine,
       Exe,
       Username,
       CreateTime
FROM pslist()
WHERE (Username =~ 'SYSTEM'
       AND Name =~ '(?i)cmd\.exe|powershell\.exe|pwsh\.exe')
   OR (Name =~ '(?i)printisolationhost\.exe'
       AND CommandLine =~ '(?i)cmd|powershell|pwsh|\\temp\\|\\users\\|\\programdata\\')

# CVE-2026-62712 (ZDI-26-621) - Verification and hardening helper
# Run elevated. Checks patch state, reports recent hotfixes, and applies interim hardening.

# 1) Confirm OS build and latest cumulative update install date
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "[i] OS: $($os.Caption) Build $($os.BuildNumber).$((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR)"

Write-Host "`n[i] Hotfixes installed in the last 60 days:"
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-60) } |
    Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize

# 2) Check for pending reboot (patches staged but not active)
$pendingReboot = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
Write-Host "`n[i] Pending reboot from Windows Update: $pendingReboot"

# 3) Interim attack-surface reduction: audit/stop the Print Spooler on systems
#    that do NOT require printing (servers, jump boxes, kiosks)
$spooler = Get-Service -Name Spooler
Write-Host "`n[i] Print Spooler status: $($spooler.Status) / StartType: $($spooler.StartType)"
Write-Host "    -> On non-print servers, disable until patched:"
Write-Host "       Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled"

# 4) Verify print driver isolation is enabled (Group Policy baseline)
$isolation = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers' -Name 'PrintDriverIsolationEnabled' -ErrorAction SilentlyContinue
if ($null -eq $isolation) {
    Write-Host "`n[!] PrintDriverIsolationEnabled policy not explicitly set. Recommended: enabled (1)."
    Write-Host "    Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers' -Name 'PrintDriverIsolationEnabled' -Value 1"
} else {
    Write-Host "`n[i] PrintDriverIsolationEnabled = $($isolation.PrintDriverIsolationEnabled)"
}

# 5) Baseline check: SYSTEM shells with non-system parents (quick local sweep of recent process ancestry requires EDR; see KQL/VQL above)
Write-Host "`n[i] Next step: run the Sentinel KQL hunt and Velociraptor artifact from the IR runbook across the fleet."