Microsoft XPS EUVD-2026-73203

The attacker must have interactive or network-authenticated local access to the target Windows system and must hold at minimum a standard (low-privilege) user account - PR:L in the CVSS vector confirms authentication is required. Exploitation additionally requires satisfying high attack complexity (AC:H), indicating that heap layout conditions, timing, or state must be precisely manipulated; a simple, reliable one-shot exploit is not indicated. Exploitation is further bounded to the local attack surface (AV:L), ruling out remote unauthenticated abuse. All currently supported Windows 10 and 11 versions and Windows Server 2012 through 2025 are within scope if unpatched. Scope remains unchanged (S:U), meaning the overflow's blast radius is confined to the vulnerable system's own privilege boundary.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly reflects a local privilege escalation with non-trivial exploitation requirements. Real-world risk is moderate: the AV:L constraint eliminates remote unauthenticated attack surface, and AC:H means reliable exploitation demands effort (heap grooming, timing, or specific system state). However, for a threat actor already present on the host - via phishing, RDP credential compromise, or earlier exploitation - this becomes an important escalation primitive toward SYSTEM or administrative access. The broad affected surface (Windows 10 through Windows 11 26H1, Windows Server 2012 through 2025) amplifies aggregate exposure. No EPSS data, no KEV listing, and no public POC were present in the input; exploitation probability is not independently quantifiable from available signals. The combination of AC:H and local-only access meaningfully suppresses real-world risk compared to the full C/I/A impact scores might suggest.

An attacker who has already obtained a standard (non-administrative) local user session - through credential theft, phishing, or exploitation of a prior vulnerability - submits a specially crafted XPS document or print job to the vulnerable Windows XPS processing component. The malformed input triggers a heap-based buffer overflow, and after manipulating heap layout to satisfy the AC:H complexity requirement (e.g., grooming the allocator to place attacker-controlled data adjacent to a critical structure), the attacker redirects execution to shellcode or a ROP chain running under an elevated context, achieving SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis.