{"id":"CVE-2026-122171","kind":"vulnerability","aliases":["CVE-2026-122171"],"related":[],"title":"Windows XPS Document Converter heap overflow allows remote code execution when a user is tricked into an action (fixed in November 2026 updates)","description":"Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.","summary":"Heap-based buffer overflow (CWE-122) in Microsoft XPS Document Converter. Microsoft rates it CVSS 8.8: network-reachable, low complexity, no privileges, but user interaction required. Fixed in the 2026-11 cumulative updates. No exploitation or public PoC seen; the trigger is not described.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","user-interaction","windows","windows-server","xps"],"not_affected_if":[],"how_to_check":"Run winver or Get-ComputerInfo and compare the OS build (major.UBR) with the fixed builds below; anything lower is exposed. Or check that the 2026-11 cumulative update is installed (Get-HotFix), e.g. KB5131080 for Server 2025, KB5131085 for Server 2019, KB5131087 for Windows 11 23H2.","fix":"Install the November 2026 (2026-11-10) Windows cumulative update. Fixed builds: Win10/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:34+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:27:46+00:00","updated_at":"2026-11-10T21:42:10+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:27:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft XPS Document Converter: heap overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft's XPS Document Converter lets an unauthenticated attacker run code over a network. The sources do not describe the trigger in more detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","xps"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the affected machine over the network.","analyst_note":"Find affected Windows versions and the Microsoft Security Update Guide entry for CVE-2026-122171 to confirm the fixed build and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems with the Microsoft XPS Document Converter component are the likely targets, according to the NVD entry's description; the sources do not name affected versions or the exact trigger. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4501,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Windows versions and the Microsoft Security Update Guide entry for CVE-2026-122171 to confirm the fixed build and any mitigation.","search":"'-11':108B '-122':82B '-122171':26A,29A '-2026':25A,28A '10':31A,36A,41A,44A '11':47A,50A,53A,56A,59A '1607':32A '1809':37A '2016':34A '2019':39A '2022':63A '2025':66A '2026':22A,107B '21h2':42A '22h2':45A '23h2':48A '24h2':51A '25h2':54A '26h1':57A '26h2':60A '8.8':92B 'action':18A 'allow':7A,132C 'attack':135C 'base':78B,124C 'buffer':79B,125C 'code':9A,138C 'complex':97B 'convert':4A,87B,131C 'cumul':109B 'cve':24A,27A 'cvss':91B 'cwe':81B 'describ':121B 'document':3A,86B,130C 'execut':10A,137C 'exploit':112B 'fix':19A,104B 'heap':5A,77B,123C 'heap-bas':76B,122C 'infrastructur':67B 'interact':70B,102B 'low':96B 'microsoft':84B,88B,128C 'network':94B,141C 'network-reach':93B 'novemb':21A 'overflow':6A,80B,126C 'poc':115B 'privileg':99B 'public':114B 'rate':89B 'reachabl':95B 'remot':8A 'requir':103B 'seen':116B 'server':33A,38A,62A,65A,74B 'trick':15A 'trigger':118B 'unauthor':134C 'updat':23A,110B 'user':13A,69B,101B 'user-interact':68B 'window':1A,71B,73B 'windows':30A,35A,40A,43A,46A,49A,52A,55A,58A,61A,64A 'windows-serv':72B 'xps':2A,75B,85B,129C","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server (2016, 2019, 2022, 2025) machine below the November 2026 build listed in the fix is affected, per Microsoft's CVE record. The attack comes over the network but needs a user action (CVSS UI:R). Workstations where people open untrusted documents are the main concern; fully patched systems can skip it. No workaround was found.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","userinteraction","windows","windowsserver","xps"],"campaign_type":null,"search_a":"'-122171':26A,29A '-2026':25A,28A '10':31A,36A,41A,44A '11':47A,50A,53A,56A,59A '1607':32A '1809':37A '2016':34A '2019':39A '2022':63A '2025':66A '2026':22A '21h2':42A '22h2':45A '23h2':48A '24h2':51A '25h2':54A '26h1':57A '26h2':60A 'action':18A 'allow':7A 'code':9A 'convert':4A 'cve':24A,27A 'document':3A 'execut':10A 'fix':19A 'heap':5A 'novemb':21A 'overflow':6A 'remot':8A 'server':33A,38A,62A,65A 'trick':15A 'updat':23A 'user':13A 'window':1A 'windows':30A,35A,40A,43A,46A,49A,52A,55A,58A,61A,64A 'xps':2A","search_b":"'-11':108B '-122':82B '2026':107B '8.8':92B 'base':78B 'buffer':79B 'complex':97B 'convert':87B 'cumul':109B 'cvss':91B 'cwe':81B 'describ':121B 'document':86B 'exploit':112B 'fix':104B 'heap':77B 'heap-bas':76B 'infrastructur':67B 'interact':70B,102B 'low':96B 'microsoft':84B,88B 'network':94B 'network-reach':93B 'overflow':80B 'poc':115B 'privileg':99B 'public':114B 'rate':89B 'reachabl':95B 'requir':103B 'seen':116B 'server':74B 'trigger':118B 'updat':110B 'user':69B,101B 'user-interact':68B 'window':71B,73B 'windows-serv':72B 'xps':75B,85B","search_c":"'allow':132C 'attack':135C 'base':124C 'buffer':125C 'code':138C 'convert':131C 'document':130C 'execut':137C 'heap':123C 'heap-bas':122C 'microsoft':128C 'network':141C 'overflow':126C 'unauthor':134C 'xps':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122171","severity":null,"published_at":"2026-11-10T19:20:34+00:00","modified_at":"2026-11-10T19:20:34+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122171:2835","url":"https://app.opencve.io/cve/CVE-2026-122171","severity":null,"published_at":"2026-11-10T21:42:10+00:00","modified_at":"2026-11-10T21:42:10+00:00","first_seen_at":"2026-11-10T21:42:10+00:00","fetched_at":"2026-11-10T21:42:10+00:00","note":"MSRC page is JS-only and unreadable here; builds taken from Microsoft's CNA record via OpenCVE mirror (secondary), so nothing marked verified. Not exploited per sources; no PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-122171"]}],"documents":[{"id":118978,"url":"https://app.opencve.io/cve/CVE-2026-122171","title":"OpenCVE: CVE-2026-122171 (Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":"Mirror of Microsoft's CVE record: affected Windows builds and fixed builds, CVSS 3.1 8.8 AV:N/AC:L/PR:N/UI:R, CWE-122, E:U (exploit unproven), RL:O.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}