Microsoft XPS Document Converter: Remote Code Execution via heap overflow

Summary

A heap-based buffer overflow in the Microsoft XPS Document Converter allows an unauthenticated attacker to execute code remotely over a network. The attack complexity is high and user interaction is required, so the realistic path is a user opening a crafted XPS document from email or a download. Microsoft's CVSS score is 7.5 (High), and the CVE record shows total impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the November 2026 Windows security update for the affected builds listed above (builds at or above the listed numbers).
• Exact KB article numbers per operating system: Unknown.

Workaround

Unknown. No workaround or mitigation is documented in the available sources. Check the MSRC advisory FAQ for mitigation guidance.

Exploitation

• No public proof of concept found.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• Microsoft's CVSS temporal metric E:U (exploit code maturity 'unproven') at publication.
• A Rapid7 report mentions one exploited vulnerability from this patch batch, but it does not name it. Exploitation of this CVE is not confirmed.

Our recommendation

• Install the November 2026 Windows security updates on all Windows 10, 11 and Server endpoints, starting with the affected builds listed above.
• Instruct staff to avoid opening untrusted XPS documents from email or downloads until patching is complete.
• Check the MSRC advisory and NVD analysis once published, and confirm the exact fixed build per operating system.
• Monitor for updated exploitation information.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-119880 msrc.microsoft.com
• CVE Record (CNA: Microsoft) www.cve.org
• Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix AI: CVE-2026-119880 (third-party, unconfirmed version data) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:31.