Description

Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unauthorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-08T18:19:54.190Z",
  "pubdate": "2026-09-08T18:19:54.190Z",
  "executiveSummary": "This vulnerability involves an integer underflow condition within the Microsoft Standard XPS processing component, which serves as a critical vector for remote code execution (RCE).\nThe vulnerability type is categorized as an integer underflow (wraparound), which occurs during the handling of specific memory allocation or buffer size calculations when processing malformed XPS (XML Paper Specification) documents.\nBy delivering a specially crafted XPS file over a network, an unauthenticated attacker can trigger this memory corruption condition, potentially leading to arbitrary code execution within the security context of the user or the underlying system process.\nThe risk is severe, as successful exploitation enables full system compromise, data exfiltration, or lateral movement within the network.\nExploitation requires no prior authentication, as the attack is typically delivered via network protocols or embedded files.\nImpacted systems include any product or component relying on Microsoft Standard XPS for rendering or document processing tasks.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper handling of arithmetic operations when calculating buffer dimensions or loop offsets during the parsing of Microsoft Standard XPS files.\nSpecifically, an integer underflow occurs when a field within the XPS structure—expected to represent a length or index—is manipulated to a value that, when processed by the application logic, results in a wrap-around to a large unsigned integer.\nThis integer underflow typically triggers an undersized memory allocation on the heap or stack. When the application subsequently proceeds to copy user-supplied data into this insufficiently large buffer, a heap-based or stack-based buffer overflow is induced.\nThe exploitation flow initiates when a target application parses a malformed XPS object. The attacker crafts the document to contain metadata or stream attributes that force an underflow during a size calculation operation. The resulting memory corruption allows the attacker to overwrite adjacent memory structures, such as object pointers, function pointers, or return addresses.\nBy carefully controlling the content of the crafted XPS document, an attacker can redirect the execution flow to a malicious payload—such as Return-Oriented Programming (ROP) chains or shellcode—injected into memory. Because this parsing often occurs at the system level or within privileged rendering services, the execution can lead to full system takeover.\nThe vulnerability is reachable over the network if the affected component processes XPS documents received via web requests, document management systems, or shared network resources. Since the vulnerability resides within the parsing logic of the XPS rendering engine, no specific user interaction beyond the opening or previewing of the malicious file is strictly required, depending on the implementation context.\nPost-exploitation behavior typically involves the deployment of secondary payloads, persistence mechanisms, or the extraction of sensitive data from the host environment, leveraging the privileges afforded to the rendering process."
}