Windows security update KB5004945 breaks printing on Zebra printers

Microsoft's recent out-of-band KB5004945 PrintNightmare security updates are preventing Windows users from printing to certain Zebra printers.

Last month, a PoC exploit for a new Windows Print Spooler remote code execution and local privilege escalation vulnerability called PrintNightmare was accidentally disclosed on GitHub.

Soon after, Microsoft acknowledged that it was actively exploited, and an unofficial 0Patch micropatch was released to temporarily fix the vulnerability.

This week, Microsoft released mandatory out-of-band Windows security updates to fix the remote code execution component of the PrintNightmare vulnerability.

Windows 10, version 21H1 (KB5004945) Windows 10, version 20H1 (KB5004945) Windows 10, version 2004 (KB5004945) Windows 10, version 1909 (KB5004946) Windows 10, version 1809 and Windows Server 2019 (KB5004947) Windows 10, version 1607 and Windows Server 2016 (KB5004948) Windows 10, version 1507 (KB5004950) Windows Server 2012 (Monthly Rollup KB5004956 / Security only KB5004960) Windows 8.1 and Windows Server 2012 R2 (Monthly Rollup KB5004954 / Security only KB5004958) Windows 7 SP1 and Windows Server 2008 R2 SP1 (Monthly Rollup KB5004953 / Security only KB5004951) Windows Server 2008 SP2 (Monthly Rollup KB5004955 / Security only KB5004959)

However, researchers quickly determined that these patches did not fix the vulnerability in all cases.

Unfortunately, the patches are also causing printing issues for some Windows users.

Security update causes printing issues

In numerous reports shared on Twitter and Reddit [1, 2, 3, 4], Windows users state that they can no longer print to certain Zebra label printers after installing the update.

"We have about 1000 customers using Zebra printers and are getting flooded with calls from them not being able to print. This update is the culprit for sure as rolling it back has things spitting out again instantly," an affected person posted to the Sysadmin subreddit.

Soon after, many other Zebra owners confirmed that they too were having issues after installing the update.

According to users affected by the bug, it is only affecting printers directly attached to Windows devices via USB. Zebra printers hooked up to a print server are not affected.

Windows users also report that only specific Zebra models are affected, with LP 2844, ZT220, ZD410, ZD500, ZD620, ZT230, ZT410, and ZT420 being some of the known models affected by the patch.

After uninstalling the security updates, users state that the printers begin to work fine again. As this is a mandatory security update, after some time, Windows will automatically reinstall the update.

It is unclear what is causing the issue, but the security update replaces the localspl.dll file with a new modified version. Changes in this DLL may be conflicting with the Zebra printer drivers and preventing printing.

For those affected, you can temporarily prevent this update from being installed again, but it is necessary to determine if printing is more important than the risks of the vulnerability.

BleepingComputer has reached out to Zebra about this issue but has not heard back at this time.