Microsoft XML CVE-2026-83935

Exploitation requires that a vulnerable, unpatched Microsoft XML (MSXML) component on an affected Windows build (e.g., Windows 11 23H2 <10.0.22631.7652, Windows Server 2025 <10.0.26100.33650, down through Server 2012/2012 R2) parses attacker-controlled XML content. Per the stated CVSS vector (PR:N, UI:N) exploitation needs no authentication and no user interaction against the parsing path, which is the theoretical worst case. Limiting factors: the attacker must be able to route crafted XML to a process that actually invokes MSXML to parse it, so real-world reachability depends on which network-facing service or application exposes MSXML parsing; applying the vendor patch to the listed minimum build versions fully removes the condition. Note the description's 'over a network' claim should be reconciled with the common MSXML pattern of requiring a victim to open/load the malicious document.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated code execution with total impact (C:H/I:H/A:H), scoring 9.8. The signals are mostly consistent and amplifying: CISA's SSVC framework rates Automatable: yes and Technical Impact: total, which aligns with an unauthenticated, no-interaction memory-corruption flaw that could be scripted at scale. The one tempering signal is SSVC Exploitation: none - meaning no observed or public exploitation at assessment time - and the CVE is NOT in CISA KEV. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no evidence of public POC code. Net: treat as urgent to patch because the affected component (Microsoft XML/MSXML) is a ubiquitous Windows parsing library and the flaw is automatable and unauthenticated, but note that active exploitation is NOT currently confirmed - the priority is driven by exposure and exploitability potential, not by observed attacks. One caveat to verify: the description says 'execute code over a network' implying a fully remote vector, yet many MSXML overflows in practice require a victim to process attacker-supplied XML (e.g., open a file or load a document), which would introduce user interaction the CVSS vector does not reflect - confirm the actual trigger path with the Microsoft advisory.

An unauthenticated remote attacker delivers a maliciously crafted XML document or stream to a service or application that parses it via the vulnerable Microsoft XML component, triggering a heap-based buffer overflow (CWE-122). Successful heap grooming leads to arbitrary code execution in the context of the parsing process. No public exploit code has been identified at the time of analysis, and the attack requires no privileges or (per the stated CVSS vector) user interaction.