{"id":"CVE-2026-95874","kind":"vulnerability","aliases":["CVE-2026-95874"],"related":[],"title":"Windows: Xbox Gaming Services heap overflow lets a local user gain SYSTEM privileges","description":"Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday fixes a heap-based buffer overflow (CWE-122) in Xbox Gaming Services on Windows. A local attacker with low privileges and no user interaction can gain SYSTEM. Microsoft lists it as not exploited and not publicly disclosed, but rates exploitation 'More Likely'. The advisory lists Windows client and server releases, not the Xbox console.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Xbox","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2/25H2","fixed":["10.0.26100.9974","10.0.26200.9974"],"affected":"< 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2)","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 10 21H2/22H2","fixed":["10.0.19044.7846","10.0.19045.7846"],"affected":"< 10.0.19044.7846 (21H2), < 10.0.19045.7846 (22H2)","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows Server 2019 / Windows 10 1809","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2016 / Windows 10 1607","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gaming-services","local","other","privilege-escalation","windows","xbox"],"not_affected_if":["patched-november-2026"],"how_to_check":"Run winver or 'cmd /c ver' and compare the OS build with the fixed build for your release (e.g. Windows 11 24H2 and 25H2 need 10.0.26100.9974 / 10.0.26200.9974 or later; Windows 11 23H2 10.0.22631.7711; Windows 10 22H2 10.0.19045.7846; Server 2025 10.0.26100.33822; Server 2019 10.0.17763.9487; Server 2016 10.0.14393.9688). Anything lower is exposed. Microsoft does not say whether the Xbox console is affected; the advisory does not list it.","fix":"Install the November 2026 cumulative update for your Windows version: KB5132061 (Win11 24H2/25H2/26H2), KB5132059 (26H1), KB5131087 (23H2), KB5131096 (Win10 21H2/22H2), KB5131085 (1809/Server 2019), KB5131291 (1607/Server 2016), KB5131080 (Server 2025). Microsoft lists no workaround.","status":"open","published_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:38:27+00:00","updated_at":"2026-11-10T20:33:08+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-10T19:38:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Xbox: heap buffer overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Xbox software lets an authorized local user elevate their privileges. The sources do not say which Xbox component or which versions are affected.","audience":"everyone","category":"other","nicknames":[],"who_cares":["xbox"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the device","analyst_note":"Find the Microsoft advisory for CVE-2026-95874 to confirm affected Xbox versions, the fixed build and whether a patch or console update is available.","how_to_check":"unknown","plain_action":"","product_name":"Xbox","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":4484,"output_tokens":363,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-95874 to confirm affected Xbox versions, the fixed build and whether a patch or console update is available.","search":"'-122':69B '-2026':15A,18A '-95874':16A,19A '10':28A,37A,43A '11':22A,25A '1607':44A '1809':38A '2016':41A '2019':35A '2025':32A '2026':58B '21h2/22h2':29A '23h2':26A '24h2/25h2':23A 'advisori':105B 'allow':123C 'attack':78B,126C 'author':125C 'base':65B,118C 'buffer':66B,119C 'client':108B 'consol':115B 'cve':14A,17A 'cwe':68B 'disclos':98B 'elev':128C 'escal':52B 'exploit':94B,101B 'fix':61B 'gain':11A,87B 'game':3A,46B,72B 'gaming-servic':45B 'heap':5A,64B,117C 'heap-bas':63B,116C 'interact':85B 'let':7A 'like':103B 'list':90B,106B 'local':9A,48B,77B,130C 'low':80B 'microsoft':55B,89B 'novemb':57B 'overflow':6A,67B,120C 'patch':59B 'privileg':13A,51B,81B,129C 'privilege-escal':50B 'public':97B 'rate':100B 'releas':111B 'server':31A,34A,40A,110B 'servic':4A,47B,73B 'system':12A,88B 'tuesday':60B 'user':10A,84B 'window':1A,53B,75B,107B 'windows':21A,24A,27A,30A,33A,36A,39A,42A 'xbox':2A,20A,54B,71B,114B,122C","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server machine (2016 to 2025) below the November 2026 build is affected, because the flaw is in Xbox Gaming Services components shipped in Windows. An attacker needs to already run code locally as a low-privileged user; it is a step for taking over a machine, not a remote entry point. Shared machines, developer workstations, VDI and servers where untrusted users or code run matter most.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:33:08Z","by":"analyst","doc":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","run_id":2671},"products":{"at":"2026-11-10T20:33:08Z","by":"analyst","doc":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","run_id":2671},"how_to_check":{"at":"2026-11-10T20:33:08Z","by":"analyst","doc":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","run_id":2671}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the latest Windows update: Settings > Windows Update > Check for updates, then restart.","pkeys":["1021h222h2","1123h2","1124h225h2","server2016windows101607","server2019windows101809","server2025","windows1021h222h2","windows1123h2","windows1124h225h2","windowsserver2016windows101607","windowsserver2019windows101809","windowsserver2025","xbox"],"ptokens":["10","11","1607","1809","2016","2019","2025","21h2","22h2","23h2","24h2","25h2","server","windows","xbox"],"labels":["gamingservices","high","local","other","privilegeescalation","vendor","windows","xbox"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95874':16A,19A '10':28A,37A,43A '11':22A,25A '1607':44A '1809':38A '2016':41A '2019':35A '2025':32A '21h2/22h2':29A '23h2':26A '24h2/25h2':23A 'cve':14A,17A 'gain':11A 'game':3A 'heap':5A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'server':31A,34A,40A 'servic':4A 'system':12A 'user':10A 'window':1A 'windows':21A,24A,27A,30A,33A,36A,39A,42A 'xbox':2A,20A","search_b":"'-122':69B '2026':58B 'advisori':105B 'attack':78B 'base':65B 'buffer':66B 'client':108B 'consol':115B 'cwe':68B 'disclos':98B 'escal':52B 'exploit':94B,101B 'fix':61B 'gain':87B 'game':46B,72B 'gaming-servic':45B 'heap':64B 'heap-bas':63B 'interact':85B 'like':103B 'list':90B,106B 'local':48B,77B 'low':80B 'microsoft':55B,89B 'novemb':57B 'overflow':67B 'patch':59B 'privileg':51B,81B 'privilege-escal':50B 'public':97B 'rate':100B 'releas':111B 'server':110B 'servic':47B,73B 'system':88B 'tuesday':60B 'user':84B 'window':53B,75B,107B 'xbox':54B,71B,114B","search_c":"'allow':123C 'attack':126C 'author':125C 'base':118C 'buffer':119C 'elev':128C 'heap':117C 'heap-bas':116C 'local':130C 'overflow':120C 'privileg':129C 'xbox':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95874","severity":null,"published_at":"2026-11-10T19:21:40+00:00","modified_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95874:2671","url":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","severity":null,"published_at":"2026-11-10T20:33:08+00:00","modified_at":"2026-11-10T20:33:08+00:00","first_seen_at":"2026-11-10T20:33:08+00:00","fetched_at":"2026-11-10T20:33:08+00:00","note":"MSRC CSAF read (via fetch summary, table truncated in raw): Xbox Gaming Services EoP on Windows; fixed builds per release; not exploited, not disclosed, no mitigations. Windows 11 26H1/26H2 fixed builds (10.0.28000.3501 / 10.0.26300.9974) not added as rows. Old 'Xbox' product row removed: console not listed. MSRC UI page is JS-only; CSAF json works.","cites":["https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17597.html/"]}],"documents":[{"id":118042,"url":"https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json","title":"MSRC CSAF: CVE-2026-95874 Xbox Gaming Services Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118043,"url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17597.html/","title":"Check Point CPAI-2026-17597 Xbox Gaming Services EoP","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}