Microsoft GDK: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow (CWE-122) in the Microsoft Game Development Kit (GDK), described in the CVE record as affecting Xbox, allows an unauthenticated attacker to execute code over the network. The CVE record assigns a CVSS 3.1 base score of 9.8 (critical). Exposure is mainly on systems where the GDK is installed, such as developer workstations and build servers; the attack requires no user interaction and no credentials.
Affected
- Microsoft GDK, versions 1.0.0.0 to before 2610 (per CVE record and third-party aggregator; lower bound not verified against MSRC)
- Unknown whether older GDK branches are affected or fixed.
Fixed in
- Microsoft GDK 2610 or later (per third-party aggregator; to be confirmed on the MSRC advisory).
Workaround
Unknown. No vendor workaround identified.
Exploitation
- No evidence of exploitation known at time of writing (not in CISA KEV per aggregator; not yet checked directly).
- No public exploit code indexed in Metasploit or Exploit-DB per aggregator.
- The CVE was published on 10 November 2026 and NVD had not yet analysed it.
Our recommendation
- Ask whether staff or contractors build with the Microsoft GDK and check for GDK installations, especially on build agents and developer machines.
- Where installed, plan an update to GDK 2610 or later after confirming the fixed version on the MSRC advisory.
- Restrict network access to GDK build machines until they are patched.
- Re-check CISA KEV and exploit trackers over the coming weeks, as the CVE is new.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide advisory (CVE-2026-66801) msrc.microsoft.com
- OffSeq CVE radar (fix version, exploitation status) radar.offseq.com
- Microsoft GDK October 2026 release (v2610) github.com
- Microsoft GDK repository github.com
- CWE-122: Heap-based Buffer Overflow cwe.mitre.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:36.
Original description (NVD)
Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.