Microsoft XPS CVE-2026-69272

Exploitation requires: (1) a low-privileged authenticated account on the target system or network (PR:L); (2) active user interaction such as opening or processing a crafted XPS document (UI:R); and (3) high attack complexity conditions that must be satisfied beyond simple packet delivery (AC:H) - the specific technical preconditions are not disclosed in available data but likely involve heap layout prerequisites or race conditions. The attacker must have network-level connectivity to deliver the malicious content to the victim. Exploitation is not feasible against default configurations without social engineering the victim into processing attacker-controlled XPS content. These three compounding constraints - authentication, user interaction, and high complexity - substantially limit the realistic attacker population compared to what the C:H/I:H/A:H impact metrics alone suggest.

The CVSS 7.1 base score reflects a network-accessible vulnerability tempered by high attack complexity (AC:H), mandatory user interaction (UI:R), and a low-privileged authentication prerequisite (PR:L). The C:H/I:H/A:H impact metrics are consistent with full privilege escalation granting complete system control. EPSS data is not provided in the available intelligence, and the absence of a KEV listing alongside no reported public POC suggests this is not currently being exploited at scale. Real-world risk is materially constrained by the three compounding factors of AC:H, UI:R, and PR:L - an attacker must hold a valid account, engineer victim interaction with malicious XPS content, and satisfy undisclosed complexity prerequisites, making mass automated exploitation implausible in the near term. The primary urgency driver is breadth: the affected surface spans nearly the entire Windows Server and Windows 10/11 fleet from 2012 onward, meaning unpatched enterprise environments carry cumulative aggregate exposure even at this moderate per-instance risk level.

An authenticated low-privileged attacker crafts a malicious XPS document and delivers it to a target user on the same network, then persuades the victim to open it via phishing or file share access. Opening the document triggers a heap buffer overflow in the Windows XPS processing component, allowing the attacker to corrupt heap memory and execute code at an elevated privilege level. No public exploit code has been identified at time of analysis, and the required user interaction and high complexity reduce the likelihood of opportunistic or automated exploitation.