Microsoft XPS EUVD-2026-73448

Exploitation requires a locally authenticated session on the target Windows host - specifically, the attacker must hold a standard user account (PR:L per CVSS) with the ability to open or process an XPS document. The attack vector is strictly local (AV:L); network-adjacent or remote exploitation is not possible without first obtaining local access through another means. The vulnerable code path is triggered during XPS document parsing; no non-default configuration setting, privileged role, or specific deployment mode is required beyond a standard user session. Limiting factors: the attacker must already possess local authentication, which excludes fully remote, unauthenticated threat actors; and the scope is unchanged (S:U), meaning exploitation cannot directly pivot to other system components.

CVSS 5.5 with AV:L/PR:L correctly characterises this as a local, authenticated-only issue, eliminating remote mass-exploitation and substantially narrowing the threat to scenarios where an adversary already holds an interactive or remote-desktop session. The High confidentiality impact (C:H) indicates that successfully triggered reads could expose meaningful memory - potentially heap contents holding tokens, credentials, or application secrets - rather than merely benign metadata. No CISA KEV listing and no public POC are present in the available data; EPSS is not supplied, leaving exploitation probability unquantified from probabilistic sources. SSVC signals point to: exploitation not detected, not readily automatable at scale due to local access requirement, and partial technical impact. In practice, even a mid-sized municipal IT team in swidnica should treat this as a standard Patch Tuesday priority - important but not an emergency requiring out-of-band response - given the local-only vector and the absence of weaponised exploit code. The 'Buffer Overflow' tag in source metadata is technically inaccurate for a CWE-125 out-of-bounds read; this mislabelling does not alter severity assessment.

A locally authenticated user on a shared Windows workstation or terminal server places a specially crafted XPS document in a location accessible to the XPS rendering path, then opens it via the XPS viewer or routes a print job through the Microsoft XPS Document Writer. The malformed document triggers the out-of-bounds read in the XPS parser, returning adjacent memory contents - potentially heap data carrying session tokens, cached credentials, or sensitive application buffers - which the attacker captures. No public exploit code has been identified, so this scenario currently requires bespoke tooling developed from the patch diff or independent research.