---
id: "CVE-2026-112967"
page: "https://infrastack.ai/live/CVE-2026-112967"
kind: "vulnerability"
aliases: ["CVE-2026-112967"]
title: "Windows Xbox Live Networking Service: heap overflow lets an attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Windows Xbox Live Networking Service", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "windows", "xbox-live"]
not_affected_if: []
published_at: "2026-11-10T19:18:46+00:00"
first_seen_at: "2026-11-10T19:24:34+00:00"
updated_at: "2026-11-10T19:35:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112967", "first_seen_at": "2026-11-10T19:24:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T19:35:25+00:00"}]
exploit_sources: []
---

# Windows Xbox Live Networking Service: heap overflow lets an attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-112967 (this .md is for agents)

A heap-based buffer overflow in the Windows Xbox Live Networking Service lets an unauthorized attacker send crafted network traffic that overwrites memory. The sources say this allows code execution over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Xbox Live Networking Service affected range not listed fixed no fixed version listed

## How to check

unknown: the MSRC advisory for CVE-2026-112967 was not readable. Check https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112967 for the affected Windows builds and KB, then compare with the installed build (winver).

## Timeline

- 2026-11-10T19:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112967
- 2026-11-10T19:35:25+00:00 analyst — gotcha: MSRC update-guide is JS-only; WebFetch gets only a title and the browser-cli session died on text; CVRF monthly API exceeds 10MB.

## From the sources

Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_