{"id":"CVE-2026-112967","published":"2026-11-10T19:18:46.937","lastModified":"2026-11-11T05:19:21.273","description":"Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-122"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112967","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A heap-based buffer overflow (CWE-122) exists in the Windows Xbox Live Networking Service, enabling remote code execution without authentication due to insufficient input validation. The vulnerability is exploitable over the network with no user interaction required.","exploitability":"Exploitation requires only network access to the vulnerable service; no authentication or user interaction is needed, making it highly exploitable by remote attackers.","blast_radius":"Successful exploitation could allow full system compromise including confidentiality, integrity, and availability impacts on affected Windows hosts running the Xbox Live Networking Service.","remediation":"No fixed version or patch level is specified in the published description; disable the Xbox Live Networking Service if not required, restrict inbound network access to its listening ports via firewall rules, and monitor for unauthorized service usage per Microsoft security guidance.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","heap-overflow","network-exploit","no-auth","windows"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:19.782Z"}}