Microsoft XPS CVE-2026-69376

Exploitation requires a valid low-privileged local user account on the affected Windows host (CVSS PR:L, AV:L) - unauthenticated or remote exploitation is not possible. No user interaction from a second party is required (UI:N); the attacker triggers the flaw unilaterally by processing a crafted XPS document through any available XPS rendering path. No non-default configuration is required since the XPS subsystem is present by default on all affected Windows versions. Limiting factors: the attacker must already hold valid credentials and local access to the target system, impact is restricted to read-only memory disclosure with no integrity or availability impact, and scope is unchanged meaning the vulnerability alone does not escape the current security context.

The CVSS 5.5 score accurately reflects a bounded but real information-disclosure risk: local attack surface, low complexity, low privilege, confidentiality-only impact, and no scope change limit the blast radius. EPSS data is absent from the input; with no CISA KEV listing and no public exploit code identified, this is a standard Patch Tuesday priority rather than an emergency response item. Even a mid-sized municipal IT team in inowroclaw managing a mixed Windows Server estate spanning 2012 through 2025 should be able to address this within a normal monthly patch cycle rather than treating it as an out-of-band incident. The aggregate exposure is notable given the breadth of affected versions - over a decade of Windows releases - but the local-only attack vector means an adversary must already have a foothold on the target system, significantly raising the bar compared to network-exploitable flaws at similar CVSS scores.

A low-privileged local user on an unpatched Windows host crafts a malformed XPS document engineered to trigger the out-of-bounds read in the Standard XPS renderer. When the document is processed - via print preview, the XPS viewer, or any application that invokes the XPS rendering pipeline - the renderer reads beyond the intended buffer boundary, leaking adjacent heap or stack memory that may contain pointer values, session tokens, or credential material. The attacker harvests these memory artifacts to defeat ASLR or support further post-exploitation steps, with no public exploit code identified at time of analysis.