Windows Xbox Live Networking Service: Heap overflow allows remote code execution
Summary
A heap-based buffer overflow in the Windows Xbox Live Networking Service allows an unauthenticated attacker to execute code over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no login and no user interaction are needed. The affected builds and fixed versions come from the CVE record published by Microsoft; the exact KB numbers and the component's default installation status could not be verified.
Affected
- Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9487
- Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7846
- Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7846
- Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7711
- Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9974
Fixed in
- Windows 10 Version 1809: 10.0.17763.9487 or later
- Windows 10 Version 21H2: 10.0.19044.7846 or later
- Windows 10 Version 22H2: 10.0.19045.7846 or later
- Windows 11 Version 23H2: 10.0.22631.7711 or later
- Windows 11 Version 24H2: 10.0.26100.9974 or later
- Windows 11 Version 25H2: 10.0.26200.9974 or later
- Windows 11 Version 26H1: 10.0.28000.3501 or later
- Windows 11 Version 26H2: 10.0.26300.9974 or later
- KB numbers: Unknown.
Workaround
Unknown.
Exploitation
- No public proof of concept or exploitation report found at the time of writing.
- Not listed in CISA KEV at the time of writing.
Our recommendation
- Install the November 2026 Microsoft security update on all affected Windows systems and verify the build number.
- Block inbound network access to affected hosts at the firewall until patched.
- Check the MSRC entry for updated exploitation status and KB numbers.
- Monitor for unusual network traffic to the Xbox Live networking service.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Critical
- Impact
- Remote code execution – Windows Xbox Live Networking Service
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131085, KB5131096, KB5131087, KB5132061, KB5132043, KB5132059
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-112967 msrc.microsoft.com
- CVE 2026 Patch Tuesday November 2026 analysis changeriskintel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:23.
Original description (NVD)
Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.