Executive brief
Microsoft Standard XPS is a document format handler used to process and display XPS (XML Paper Specification) files. An integer underflow vulnerability in this component allows an authorized local user to elevate their privileges on the system. This could enable unauthorized administrative access or system compromise.
Technical details
This vulnerability is an integer underflow (wrap or wraparound) vulnerability in Microsoft Standard XPS. The flaw allows an authorized local attacker to trigger an integer underflow condition, which can lead to memory corruption or other undefined behavior. The attack requires prior authentication/authorization on the system and local access. Successful exploitation permits privilege escalation to a higher privilege level. Microsoft has released patches to address this issue.
Affected products
- Microsoft Standard XPS
Timeline
- 2026-09-08: disclosed