Microsoft Standard XPS EUVD-2026-73417

Exploitation requires a valid low-privilege local user account on an affected Windows system - the CVSS PR:L metric confirms authentication is necessary, and AV:L confirms the attack cannot be conducted remotely without prior local access. The attacker must trigger XPS document processing, which occurs through interactions such as opening a crafted .xps file, printing via the XPS print queue, or invoking XPS rendering through the Windows print subsystem. No non-default configuration is required; the vulnerable XPS component is present and active in default Windows installations across all listed versions. The local attack vector (AV:L) is the primary limiting factor: remote unauthenticated attackers cannot exploit this directly and must first establish local presence (e.g., via phishing leading to code execution, or a pre-existing foothold). No user interaction from a third party is required once the attacker can trigger XPS processing themselves.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation that requires only a standard authenticated account and no user interaction, with no network exposure requirement. No EPSS score is provided in the available data; however, the vulnerability is absent from the CISA KEV catalog and no public POC has been identified, suggesting no confirmed mass exploitation at time of analysis. The realistic threat model centres on insider threats, compromised low-privilege accounts, or post-initial-access lateral movement - scenarios where even a mid-sized municipal IT team in kielce should treat this as urgent given the breadth of affected Windows versions spanning Server 2012 through Server 2025 and Windows 10 through 11 25H2. The C:H/I:H/A:H impact triad means a successful exploit yields full system control, making patch prioritisation critical despite the local-only vector.

A locally authenticated standard user on an unpatched Windows system triggers XPS processing - for example, by printing to an XPS print queue or opening a crafted .xps file - passing input that overflows a heap buffer in the Microsoft Standard XPS component. The overflow corrupts adjacent heap structures, allowing the attacker to redirect control flow and execute arbitrary code at an elevated privilege level, likely SYSTEM. No public exploit or POC has been identified at time of analysis, but the low attack complexity rating (AC:L) suggests reliable exploitation once a working technique is developed.