Microsoft XPS CVE-2026-69313

Exploitation requires the attacker to hold at least low-level network authentication (PR:L) - anonymous, unauthenticated exploitation is not indicated by the CVSS vector. User interaction (UI:R) is required, meaning a victim must actively open or process a crafted XPS document. Attack complexity is high (AC:H), implying specific preconditions - likely a particular XPS document structure or heap layout - must be met, limiting reliable exploitation. The vulnerable component is the Windows XPS subsystem, which is present by default on all affected Windows versions but is most exposed on systems actively processing XPS documents (print servers, document management systems). There is no indication that non-default configuration is required to be vulnerable; the XPS subsystem is enabled by default.

The CVSS base score of 7.1 with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a meaningful but constrained exploitation scenario. The AC:H and UI:R modifiers significantly reduce real-world exploitation probability: the attacker must be authenticated with at least low privilege and must induce a target user to interact with a crafted XPS artifact, under specific conditions that raise complexity. Despite the full triad impact, the scope-unchanged (S:U) flag means the privilege escalation is bounded to the vulnerable system itself. No EPSS data was provided, no POC is known at time of analysis, and the vulnerability is not in the CISA KEV catalog - signals consistent with a theoretically serious but not actively weaponized issue. The exceptionally broad version coverage (19 distinct Windows product lines) substantially increases the aggregate exposed population even if individual exploitation is complex. Defenders should prioritize patching on systems running XPS-heavy workloads such as print servers and document management servers.

A low-privileged domain user on a corporate network crafts a malicious XPS document embedding a payload designed to trigger a heap overflow in the Windows XPS parser. The attacker delivers this document to a victim (e.g., via email or a shared network drive) and induces the victim to open it. On a vulnerable, unpatched system, the heap corruption redirects execution, granting the attacker SYSTEM-level privileges on that machine. No public exploit code is known at time of analysis, and the AC:H/UI:R prerequisites make this scenario less trivially repeatable than unauthenticated network-reachable flaws.