What is the CVSS score of CVE-2026-55010?

CVE-2026-55010 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Minecraft Bedrock Server are affected by CVE-2026-55010?

Minecraft Bedrock Dedicated Server contains a critical remote code execution vulnerability (CVE-2026-55010, CVSS 9.8) that allows unauthenticated network attackers to execute arbitrary code on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55010?

Yes, a public proof-of-concept exploit is available for CVE-2026-55010. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-55010?

Within 24 hours, identify all Minecraft Bedrock Dedicated Servers in your infrastructure and obtain the latest patch from Microsoft's advisory. Within 7 days, stage and test the patch on development and non-production servers to ensure compatibility with your configuration. Within 30 days, deploy the patch to all production Bedrock servers and verify that all instances have been updated to the patched version.

Minecraft Bedrock Server CVE-2026-55010

EUVD-2026-44151 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-xf2v-8394-h23j

Buffer Overflow Heap Overflow Microsoft Minecraft Bedrock Dedicated Server

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable packet parsing (AV:N/AC:L/PR:N/UI:N); native-code heap RCE yields full C/I/A within the server process, no cross-system scope change (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:34 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

CRITICAL 9.8

DescriptionCVE.org

Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Minecraft Bedrock Dedicated Server allows an unauthenticated network attacker to corrupt heap memory and run arbitrary code via a specially crafted packet, per CVSS:3.1/AV:N/AC:L/PR:N/UI:N (9.8 Critical). The flaw (CWE-122 heap-based buffer overflow) was reported by Microsoft, which has released a fix; there is no public exploit identified at time of analysis and no EPSS or CISA KEV data was supplied, so exploitation remains theoretical but the pre-auth, low-complexity profile makes it high-priority to patch.

Technical ContextAI

Minecraft Bedrock Dedicated Server (BDS) is Microsoft's standalone C++ server binary used to host multiplayer Bedrock Edition worlds over the network, typically using the RakNet UDP protocol on port 19132. The vulnerability is classed as CWE-122 (heap-based buffer overflow): the server allocates a buffer on the heap and writes attacker-influenced data past its bounds, corrupting adjacent heap metadata or object pointers. In native code servers like BDS this class of bug commonly stems from unvalidated length fields or malformed packet parsing during the connection/handshake or in-game message handling, and can be leveraged from memory corruption into control-flow hijack and code execution. The single affected CPE is cpe:2.3:a:microsoft:minecraft_bedrock_dedicated_server:*:*:*:*:*:*:*:*, indicating all versions prior to the vendor fix are in scope.

RemediationAI

Apply the vendor fix: Patch available per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010 - download and deploy the latest Bedrock Dedicated Server build from Microsoft, as the exact fixed version was not specified in the supplied data and should be confirmed from the MSRC page. Until patched, reduce exposure by not binding the server directly to the public internet: place it behind a firewall and restrict inbound UDP 19132 (and 19133 for IPv6) to known player IP ranges or a VPN, use a whitelist/allowlist so only authorized players connect, and consider fronting with a proxy that validates traffic. These network controls limit who can reach the vulnerable parser but do not eliminate the bug and may inconvenience legitimate players connecting from dynamic addresses, so patching remains the only complete fix.