CVE-2026-66801

CriticalCVSS 9.8/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-668028.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allowCVE-2026-6680310.0Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.CVE-2026-668047.8Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2026-668058.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-668065.5Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-668077.8Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-668088.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-668095.5Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-66815.3The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of CVE-2026-668105.5Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-668138.1Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network.CVE-2026-668148.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-66801: Critical severity, CVSS 9.8 | Vulnix