EIP-2026-117533

This exploit leverages a TOCTOU (Time-of-Check to Time-of-Use) vulnerability in the Windows XPS Print Spooler to escape sandbox restrictions. It abuses the spooler's token elevation behavior and a symlink attack via NtImpersonateAnonymousToken to write arbitrary files outside the sandbox, achieving local privilege escalation.