Xbox Gaming Services
Monthly
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Xbox Gaming Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Xbox Gaming Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.