Minecraft Bedrock Server RCE: CVE-2026-55010

Status as of August 4, 2026: patched by Microsoft as part of the July 14, 2026 Patch Tuesday release. No active exploitation confirmed by Microsoft as of this writing, unlike the SharePoint and ADFS zero-days patched the same day. Treat "not yet seen in the wild" as a head start, not a reason to wait.

Buried in a Patch Tuesday pile of 570 fixes, next to Windows DHCP bugs and an Age of Empires II patch, sat CVE-2026-55010: a CVSS 9.8 heap-based buffer overflow in Minecraft Bedrock Dedicated Server that lets an unauthenticated attacker execute code on your server by sending it a single malformed packet. No account, no password, no player already connected. If you or your kid runs a Bedrock server for friends and family, this is the one Patch Tuesday entry from July worth reading past the headline.

What CVE-2026-55010 actually is

The vulnerability is a heap-based buffer overflow (CWE-122) in the Bedrock Dedicated Server binary, the free downloadable server software Mojang and Microsoft ship separately from the game itself, the thing most self-hosted Bedrock servers actually run. It's network-reachable, requires low attack complexity, no privileges, and no user interaction. In CVSS terms, that's AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-accessible, easy to trigger, and full impact to confidentiality, integrity, and availability if it lands.

Practically: an attacker doesn't need a Minecraft account, doesn't need your server's password if you've set one, and doesn't need anyone to be actively playing. Malicious network traffic sent directly at the server's exposed port is enough to trigger the overflow. Microsoft's advisory doesn't publish a specific affected-versions range, which is unusual and worth noting, but every independent write-up agrees the fix is: update to the current Bedrock Dedicated Server build from minecraft.net.

Why Microsoft's own page is confusing about this

Here's the part worth being upfront about. Microsoft's Security Update Guide entry for this CVE carries the standard "this is a cloud service vulnerability, it's already been mitigated, there's nothing for you to do" boilerplate that Microsoft uses for bugs fixed entirely on their own infrastructure. Taken at face value, that reads like nothing needs to happen on your end.

Every independent security outlet that covered this vulnerability disagrees, and specifically calls out that the boilerplate doesn't apply to self-hosted deployments. The distinction that resolves this: Bedrock has two separate multiplayer paths. Microsoft's own hosted Realms service is server-side infrastructure Microsoft controls and patches centrally, that's plausibly what the "no action needed" language refers to. The separately-distributed Bedrock Dedicated Server binary, the thing you or a friend downloads and runs on a home server or VPS, is a different artifact entirely, and it's the one every independent report ties this CVE to by name. If you're running BDS yourself, treat this as something you need to act on, not something Microsoft already handled for you.

What to actually do

1. Download the current Bedrock Dedicated Server build from Minecraft's official server download page. Verify the download hash if the page provides one.
2. Stop the old process, replace the binary, restart. Config files (server.properties, permissions, world data) aren't affected by the binary swap.
3. If you're not running the latest build and can't update immediately, don't leave the server directly reachable. Put it behind a VPN or tunnel instead of a raw port forward, so only people you've actually granted access can reach it at all, regardless of patch status.
4. Run the server process under an unprivileged account, not as an administrator or root. If this specific overflow (or the next one) does achieve code execution, an unprivileged process limits what that code execution can actually do to the rest of your box.
   That third point matters beyond this one CVE. A Bedrock server exposed straight to the internet for convenience is a common setup, and it's exactly the kind of thing this vulnerability class targets. A tunnel or VPN in front of it costs you nothing in gameplay and removes an entire category of exposure.

This isn't Bedrock's only heap overflow this year

Worth knowing for context: security researchers at OtterSec published a separate technical writeup in June 2026 demonstrating a different heap overflow, a 4-byte overflow achieving client-side remote code execution by joining a malicious server, in Minecraft Bedrock's protocol handling. That's a distinct bug from CVE-2026-55010 and attacks the opposite direction (a malicious server compromising a connecting client, rather than a malicious client compromising the server), but it's the same general bug class showing up twice in a few months in the same protocol stack. If you administer a Bedrock server, both directions are worth taking seriously, keep your server binary current, and be cautious about which servers you or your kids connect to as a client, too.

If you're running this on the same box as anything else

A lot of self-hosted Bedrock servers live on the same home server or budget VPS as other self-hosted apps, exactly the kind of setup covered elsewhere on this site. An unauthenticated RCE on any one service on that box is a reason to think about network segmentation, not just patch status: does the Bedrock server actually need to be reachable from the open internet, or would a private tunnel to just the people who play on it close this exposure (and the next one) entirely?