CVE-2026-119880: Microsoft XPS Document Converter Remote Code Execution Vulnerability

Published Nov 10, 2026

Updated

Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.

Other sources

Microsoft XPS Document Converter Remote Code Execution Vulnerability

— Microsoft

1 affected component

Microsoft XPS Document Converter

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

CVE Published

via MITRE·06:23 PM

Data Sourced

via MITRE·06:23 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

The attacker would need to exploit the vulnerable converter over a network and requires user interaction. No privileges are required.

Successful exploitation could allow code execution and may affect the confidentiality, integrity, and availability of the affected system.