CVE-2026-68885

CVE-2026-68885 is a heap-based buffer overflow (CWE-122) in Microsoft Standard XPS, the XPS document component shipped as part of the Windows print/document pipeline. An attacker who already has a foothold as a standard user on the machine (CVSS AV:L/PR:L) can trigger the overflow by getting the component to process crafted document content, and no user interaction is required (UI:N). Successful exploitation elevates the attacker's privileges to a higher local context, with high impact on confidentiality, integrity, and availability — effectively full local compromise of the host. Any Windows installation that includes the Standard XPS component is affected, which by default means current Windows client and server deployments. Exploitation status: no public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.3%, 25th percentile) indicate no known exploitation at this time.

What to do: Install Microsoft's security update for CVE-2026-68885 via Windows Update as soon as it is offered, and check Microsoft's advisory for the affected/fixed Windows builds (not enumerated in the available data). Prioritize multi-user hosts — RDS/terminal servers, shared workstations, and VDI — where low-privilege local users log in, since exploitation requires local access; with no public PoC or in-the-wild exploitation known and EPSS at 0.3%, routine patch-cycle handling is reasonable for most environments.