The vulnerability is a heap-based buffer overflow in the Microsoft Standard XPS component. Exploitation of the overflow allows an authorized attacker to gain higher privileges within the system, effectively elevating their access rights. The weakness is classified as CWE‑122, indicating improper handling of a heap-based memory buffer.

Affected are numerous Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and Core installations. Systems running any of these environments and using the Standard XPS functionality are susceptible.

The CVSS score of 7.1 places the vulnerability in the high‑severity band, suggesting significant potential impact. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV, indicating no publicly known widespread exploitation. The likely attack vector is over a network, requiring that the attacker has authorized access but can trigger the overflow via XPS handling mechanisms. Overall risk is moderate to high for environments where Standard XPS is exposed and not patched.