Heap-based buffer overflow in Microsoft Standard XPS enables an attacker with local user privileges to gain higher privileges on the affected Windows system. The flaw is classified as CWE-122, indicating improper handling of heap memory. An exploitation would allow the attacker to execute arbitrary code with elevated privileges, potentially compromising system integrity and confidentiality.

Affected releases include Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, and all Windows Server releases from 2012 through 2025, covering both 32‑bit and 64‑bit builds where specified. The vulnerability impacts the Microsoft Standard XPS component present in these operating systems.

The CVSS score of 7.8 reflects a high severity local privilege escalation risk. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is currently not listed in CISA’s KEV catalog. The attack vector is local, requiring the attacker to trigger the vulnerable XPS processing component, such as by opening a specially crafted XPS file or otherwise invoking the feature. While exploitation requires local access, the availability of the Standard XPS service on many installations means that unpatched or misconfigured systems remain vulnerable.