Windows XPS EUVD-2026-73206

Exploitation requires a local authenticated session with at least standard user (PR:L) privileges on the target Windows system - unauthenticated or remote exploitation is not possible per the AV:L CVSS vector. The attacker must be able to induce processing of a crafted XPS document, either by opening it directly in the XPS viewer/reader, sending it to the print spooler, or through another XPS-parsing code path. No non-default configuration is required; XPS support is a default Windows component. Exploitation is limited by the need for local access and produces only information disclosure - there is no integrity or availability impact per the CVSS vector, reducing the standalone severity of this flaw.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack profile: exploitation requires local authenticated access with at least standard user privileges, no elevated rights, and no user interaction. The C:H rating indicates a potentially significant memory disclosure, but the local-only attack vector is the primary risk limiter - remote exploitation is not possible without a pre-existing foothold. No EPSS score was provided in the input data, no CISA KEV listing exists, and no public proof-of-concept has been identified. The 'Buffer Overflow' tag in the input metadata conflicts with the CWE-125 (Out-of-bounds Read) classification; this is a read-only memory exposure, not a write overflow, which further reduces the likelihood of reliable code execution being chained from this flaw alone. Real-world priority is moderate: a post-exploitation information disclosure useful for privilege escalation chains but not a standalone network-facing threat.

A local attacker with a standard domain or local user account places a crafted XPS document on the target system - for example, via a network share or phishing download - and opens it through the Windows XPS viewer or print subsystem. The malformed XPS triggers the out-of-bounds read, leaking adjacent memory that may contain heap metadata, other documents' content, or sensitive in-process data. This disclosure could be chained with a separate privilege escalation vulnerability to facilitate a more complete compromise.