Microsoft Windows XPS CVE-2026-68890

Exploitation requires an authenticated local user session with at least low-privilege access (PR:L); unauthenticated or remote exploitation is not possible per the AV:L vector. No special non-default configuration is required - the XPS component is present and enabled by default across all affected Windows versions. The attacker must be able to trigger XPS document processing, either by directly invoking the XPS viewer, leveraging print-to-XPS workflows, or passing a crafted document through any application that internally invokes the Windows XPS stack. Exploitation is limited to the local system (S:U, no scope change to adjacent systems). No user interaction from a victim is required once the attacker has local access.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a low-complexity local privilege escalation requiring only a standard user account. The attack surface is constrained to local authenticated sessions, which limits opportunistic mass exploitation compared to network-reachable vulnerabilities; however, the absence of special configuration requirements and the very broad affected version range - spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 - means the exploitable population is enormous. Even a mid-sized municipal IT team in boleslawiec operating mixed Windows Server 2019/2022 fleets should treat this as urgent patching given that low-privilege accounts (e.g., helpdesk, service accounts) are common lateral-movement footholds post-initial-access. EPSS data is not provided, and no KEV listing or public POC has been identified, suggesting exploitation is not yet widespread. However, heap overflow LPE primitives in core Windows components historically attract post-public-POC weaponization within weeks of patch release, as defenders and attackers both reverse the patch diff.

An attacker who has obtained a low-privilege local account - through credential theft, phishing, or prior lateral movement - submits a specially crafted XPS document to the Windows XPS handler, triggering a heap buffer overflow that corrupts adjacent heap structures. By carefully grooming the heap layout, the attacker redirects execution flow to attacker-controlled code, achieving SYSTEM-level or administrator-level privilege on the target host. No public proof-of-concept has been identified at time of analysis, but the low-complexity CVSS vector indicates the exploitation path does not require unusual preconditions beyond a valid user session.