Microsoft Windows XPS CVE-2026-69367

The attacker must have an active local session on the affected Windows machine with at minimum standard user-level privileges (PR:L). The exploitation path requires triggering XPS document processing - the attacker either directly opens an .xps file via an XPS-capable application or routes output through the XPS print subsystem. No user interaction from a second victim is required (UI:N). Exploitation is limited by the local-only attack vector: remote unauthenticated access is not possible. Special configuration or non-default settings are not required - the XPS subsystem is present and active in default Windows installations. The scope is unchanged (S:U), so the attacker cannot leverage this read primitive to directly escape their current process privilege boundary; the impact is confined to information disclosure within the scope of the vulnerable session.

Real-world risk is moderate and bounded by the local attack vector. The CVSS 5.5 reflects the AV:L constraint accurately - an attacker must already have low-privileged local access to the target machine, which substantially limits the attacker population compared to network-reachable vulnerabilities. EPSS data is absent from the provided intelligence, and the vulnerability is not in CISA KEV and has no confirmed public exploit code, both of which reduce urgency. However, the breadth of affected platforms - encompassing Windows 10/11 consumer and server variants from 2012 to present - means the aggregate exposed population is enormous even if individual exploitation is constrained to local paths. The C:H rating is notable: a successful read can disclose high-fidelity memory contents, potentially including cryptographic material or authentication tokens. In multi-tenant environments (shared VMs, terminal services, RDS farms) where multiple untrusted local users co-exist, the practical exploitability rises meaningfully. The 'Buffer Overflow' tag in the input is a mislabel and should be disregarded for risk classification - this is a read primitive, not a write primitive, and does not by itself enable code execution.

A low-privileged local user or process on a shared Windows server - for example, an RDS session user - crafts or obtains a malicious XPS document and triggers its processing through the Standard XPS subsystem, either by opening it or by invoking a print-to-XPS operation. The out-of-bounds read returns memory contents from an adjacent allocation, potentially exposing ASLR base addresses or in-memory secrets belonging to the service or another co-resident process. No public exploit code exists at time of analysis, but the AC:L rating indicates the read is reliably triggerable without race conditions or unusual timing.