CVE-1999-0899

Windows NT 4.0 - Local Privilege Escalation via Print Spooler Alternate Provider

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-1999-0899. PoCs published by Marc of eEye.

AI-analyzed exploit summary The exploit describes a local privilege escalation vulnerability in the spooler service (spoolss.exe) via the AddPrintProvider() function, allowing local users to execute arbitrary DLLs at SYSTEM level. The writeup outlines the attack vector but does not include functional exploit code.

Description

The Windows NT 4.0 print spooler allows a local user to execute arbitrary commands due to inappropriate permissions that allow the user to specify an alternate print provider.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Marc of eEye · textlocalwindows

https://www.exploit-db.com/exploits/19594

View Code ZIP pw:eip

The exploit describes a local privilege escalation vulnerability in the spooler service (spoolss.exe) via the AddPrintProvider() function, allowing local users to execute arbitrary DLLs at SYSTEM level. The writeup outlines the attack vector but does not include functional exploit code.

Classification

Writeup 90%

Attack Type

Lpe

Complexity

Moderate

Reliability

Theoretical

Target: Microsoft Windows spooler service (spoolss.exe)

Auth required

Prerequisites: Local access to the target system · Ability to restart the spooler service

MITRE ATT&CK

T1547.001 - Registry Run Keys / Startup Folder T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-047

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/769

Vendor Advisory vendor-advisory x_refsource_mskb

http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ243649

Scores

EPSS 0.0323

EPSS Percentile 86.6%

Details

CWE

CWE-264

Status published

Products (1)

microsoft/windows_nt 4.0 (7 CPE variants)

Published Nov 04, 1999

Tracked Since Feb 18, 2026