Executive brief
Microsoft Standard XPS is a document format handler used across Microsoft Office and Windows systems for reliable document viewing and exchange. A heap-based buffer overflow vulnerability allows an authorized local user to execute arbitrary code with elevated privileges, potentially leading to full system compromise or data theft.
Technical details
The vulnerability is a heap-based buffer overflow in Microsoft Standard XPS, triggered during document processing when insufficient bounds checking is performed on user-controlled input. The attack requires local access and elevated user privileges to exploit. Successful exploitation allows an attacker to corrupt heap memory, overwrite critical data structures, and execute arbitrary code in the context of the affected process, resulting in privilege escalation to system or administrative level. A patch is expected from Microsoft; check the Security Update Guide for availability and deployment status.
Affected products
- Microsoft Standard XPS
Timeline
- 2026-09-08: disclosed