Windows XPS Component EUVD-2026-73219

Exploitation requires a low-privileged authenticated account on the target network or system (PR:L - 'authorized attacker' per description). A local or remote user must actively open or process a malicious XPS document (UI:R), meaning the attacker must deliver the document and convince a target to open it. High attack complexity (AC:H) implies specific heap state or timing conditions must be achieved, likely requiring targeted exploitation rather than spray-and-pray. The attack is network-reachable (AV:N), consistent with XPS document delivery or processing via network-shared printers, document repositories, or print spooler. Exploitation is not possible without user interaction. Systems where XPS document processing is disabled or where users do not open externally-supplied XPS files have substantially reduced practical exposure. Windows Server 2012/2012 R2 systems without Extended Security Update subscriptions will not receive patches through standard channels.

The CVSS 7.1 score appropriately reflects real-world exploitation constraints: AC:H indicates that reliable heap exploitation requires precise memory grooming or timing conditions, while UI:R demands that a target user actively process the malicious XPS document. These barriers meaningfully reduce the exploitability compared to simpler vulnerabilities despite the full CIA:H impact. No CISA KEV listing and no public POC code are present in the input data, confirming no known active exploitation at time of analysis. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be independently quantified. The breadth of affected systems - 19 Windows/Server configurations including end-of-support Windows Server 2012 and 2012 R2, which may not receive patches through standard channels without Extended Security Updates - represents an elevated residual risk for organizations running legacy infrastructure. The S:U scope limits compromise to the directly affected system, but CIA:H upon successful exploitation means full system compromise is achievable. Organizations should prioritize patch deployment given the wide footprint.

An attacker with a low-privileged network account crafts a malicious XPS document engineered to trigger a heap buffer overflow in the Windows XPS processing component. The attacker delivers this document via a shared network folder, email attachment, or print queue and induces the target user to open it, satisfying the UI:R requirement. Upon successful heap exploitation - requiring precise memory layout conditions (AC:H) - the attacker redirects execution to shellcode or a ROP chain, elevating privileges to SYSTEM or another high-integrity context. No public proof-of-concept has been identified at time of analysis.