CVE-2026-112967

Summary

A heap-based buffer overflow (CWE-122) exists in the Windows Xbox Live Networking Service, enabling remote code execution without authentication due to insufficient input validation. The vulnerability is exploitable over the network with no user interaction required.

Exploitability

Exploitation requires only network access to the vulnerable service; no authentication or user interaction is needed, making it highly exploitable by remote attackers.

Blast radius

Successful exploitation could allow full system compromise including confidentiality, integrity, and availability impacts on affected Windows hosts running the Xbox Live Networking Service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version or patch level is specified in the published description; disable the Xbox Live Networking Service if not required, restrict inbound network access to its listening ports via firewall rules, and monitor for unauthorized service usage per Microsoft security guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.