--- id: "CVE-2026-95874" page: "https://infrastack.ai/live/CVE-2026-95874" kind: "vulnerability" aliases: ["CVE-2026-95874"] title: "Windows: Xbox Gaming Services heap overflow lets a local user gain SYSTEM privileges" severity: "high" cvss: 7.8 epss: null exploited: false status: "open" category: "other" products: [{"name": "Xbox", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 11 24H2/25H2", "fixed": ["10.0.26100.9974", "10.0.26200.9974"], "affected": "< 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2)", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 10 21H2/22H2", "fixed": ["10.0.19044.7846", "10.0.19045.7846"], "affected": "< 10.0.19044.7846 (21H2), < 10.0.19045.7846 (22H2)", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "Windows Server 2019 / Windows 10 1809", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows Server 2016 / Windows 10 1607", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["gaming-services", "local", "other", "privilege-escalation", "windows", "xbox"] not_affected_if: ["patched-november-2026"] published_at: "2026-11-10T19:21:40+00:00" first_seen_at: "2026-11-10T19:25:22+00:00" updated_at: "2026-11-10T20:33:08+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95874", "first_seen_at": "2026-11-10T19:25:22+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json", "first_seen_at": "2026-11-10T20:33:08+00:00", "cites": ["https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json", "https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17597.html/"]}] exploit_sources: [] --- # Windows: Xbox Gaming Services heap overflow lets a local user gain SYSTEM privileges Link for people: https://infrastack.ai/live/CVE-2026-95874 (this .md is for agents) Microsoft's November 2026 Patch Tuesday fixes a heap-based buffer overflow (CWE-122) in Xbox Gaming Services on Windows. A local attacker with low privileges and no user interaction can gain SYSTEM. Microsoft lists it as not exploited and not publicly disclosed, but rates exploitation 'More Likely'. The advisory lists Windows client and server releases, not the Xbox console. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Xbox affected range not listed fixed no fixed version listed - vendor:Windows 11 24H2/25H2 affected < 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2) fixed 10.0.26100.9974, 10.0.26200.9974 - vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711 - vendor:Windows 10 21H2/22H2 affected < 10.0.19044.7846 (21H2), < 10.0.19045.7846 (22H2) fixed 10.0.19044.7846, 10.0.19045.7846 - vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822 - vendor:Windows Server 2019 / Windows 10 1809 affected < 10.0.17763.9487 fixed 10.0.17763.9487 - vendor:Windows Server 2016 / Windows 10 1607 affected < 10.0.14393.9688 fixed 10.0.14393.9688 ## How to check Run winver or 'cmd /c ver' and compare the OS build with the fixed build for your release (e.g. Windows 11 24H2 and 25H2 need 10.0.26100.9974 / 10.0.26200.9974 or later; Windows 11 23H2 10.0.22631.7711; Windows 10 22H2 10.0.19045.7846; Server 2025 10.0.26100.33822; Server 2019 10.0.17763.9487; Server 2016 10.0.14393.9688). Anything lower is exposed. Microsoft does not say whether the Xbox console is affected; the advisory does not list it. ## Fix Install the November 2026 cumulative update for your Windows version: KB5132061 (Win11 24H2/25H2/26H2), KB5132059 (26H1), KB5131087 (23H2), KB5131096 (Win10 21H2/22H2), KB5131085 (1809/Server 2019), KB5131291 (1607/Server 2016), KB5131080 (Server 2025). Microsoft lists no workaround. ## Timeline - 2026-11-10T19:25:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95874 - 2026-11-10T20:33:08+00:00 analyst https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json — MSRC CSAF read (via fetch summary, table truncated in raw): Xbox Gaming Services EoP on Windows; fixed builds per release; not exploited, not disclosed, no mitigations. Windows 11 26H1/26H2 fixed builds (10.0.28000.3501 / 10.0.26300.9974) not added as rows. Old 'Xbox' product row removed: console not listed. MSRC UI page is JS-only; CSAF json works. ## Documents - [advisory] MSRC CSAF: CVE-2026-95874 Xbox Gaming Services Elevation of Privilege Vulnerability https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-95874.json - [mentions] Check Point CPAI-2026-17597 Xbox Gaming Services EoP https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17597.html/ ## From the sources Heap-based buffer overflow in Xbox allows an authorized attacker to elevate privileges locally. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_