Microsoft XPS EUVD-2026-73227

Exploitation requires a low-privileged authenticated local session on the target Windows host (PR:L, AV:L confirmed by CVSS vector). The attacker must be able to submit or open a crafted XPS document to trigger the XPS parsing component. No network access is required and no user interaction beyond the attacker's own actions is needed (UI:N). Exploitation is limited by the local access requirement - remote unauthenticated exploitation is not possible. The vulnerability does not affect confidentiality of systems outside the vulnerable host (S:U). No special non-default configuration is required; the XPS component is present by default on all affected Windows builds.

Real-world risk is moderate despite the C:H confidentiality rating. The CVSS 5.5 Medium score is well-calibrated: local access (AV:L) and low-privilege requirement (PR:L) mean an attacker cannot exploit this remotely or without an existing foothold. EPSS data was not provided, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The primary concern is post-compromise lateral movement or privilege escalation via memory disclosure - an attacker who has already gained local access could use this to leak sensitive memory and chain it with another vulnerability. The extremely broad platform coverage (19 distinct Windows builds, including legacy Server 2012) expands the remediation burden. No POC code has been identified, which further tempers urgency. The 'Buffer Overflow' tag in the input metadata is a mislabel - CWE-125 is distinctly an out-of-bounds read, not a write-based buffer overflow, meaning exploitation cannot directly overwrite memory for code execution.

A low-privileged local user crafts or obtains a malformed XPS document and opens it or sends it to the print subsystem on a vulnerable Windows host. The out-of-bounds read condition is triggered during XPS parsing, leaking adjacent memory contents - potentially including other processes' sensitive data or kernel structures - back to the calling user. No public exploit code has been identified at time of analysis, so this scenario currently requires manual crafting of a malformed XPS payload.