A heap-based buffer overflow in Microsoft Standard XPS can be triggered by maliciously crafted XPS content, allowing an authorized local user to execute arbitrary code with elevated privileges. This is a classic instance of memory corruption mapped to CWE-122, giving attackers the ability to gain higher privileges and potentially take full control of the system.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, across the architectures listed in the entry.

The CVSS score of 7 indicates a moderate to high potential impact. Exploitation requires local access to a user with sufficient privileges to manipulate Standard XPS processing and to load crafted documents; no remote or network-based vectors are documented. The EPSS value is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. If an attacker can supply a malicious XPS file on a compromised local account, privilege escalation would be possible, creating a high risk to systems where Standard XPS is enabled.