Microsoft XPS EUVD-2026-73427

Exploitation requires a local, low-privileged authenticated session on the target Windows host - this includes standard domain users with interactive logon or Remote Desktop Protocol access. The attacker must be able to trigger XPS document processing, either by opening a crafted .xps file or invoking an application that passes attacker-controlled XPS data to the subsystem. No special Windows features need to be enabled beyond the default XPS components, which ship enabled in all affected SKUs. Exploitation is limited to the local machine (AV:L, S:U) - lateral movement to other systems requires a separate step. Windows Server 2012 and 2012 R2 are past mainstream support, meaning extended security updates (ESU) are the only patch delivery mechanism for those SKUs.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and represents a realistic, actionable risk: any standard (non-admin) user logged on locally or via RDP can trigger the underflow without any additional interaction or special configuration. The S:U (scope unchanged) is the primary mitigating factor - exploitation is bounded to the compromised host. No EPSS data was provided and the vulnerability is not in CISA KEV, suggesting no observed mass exploitation at time of analysis, but the low complexity and broad platform footprint make this an attractive target for ransomware and post-exploitation privilege escalation chains. The mismatch between the 'Information Disclosure' tag and the actual privilege escalation impact is a data quality concern - defenders should not underestimate this as a disclosure-only issue. The broad version range (19 distinct Windows SKUs/versions) substantially increases the likelihood that unpatched systems exist in most enterprise environments.

An attacker with a standard domain user account on a Windows workstation or RDP session opens or processes a specially crafted XPS document, triggering an integer underflow in the XPS rendering component. The resulting wraparound corrupts heap metadata or bypasses a size check, enabling the attacker to write shellcode or a privilege token escalation payload into kernel or privileged process memory, ultimately achieving SYSTEM-level code execution on the host.