CVE-2026-50663: Age of Empires II Path Traversal Flaw

CVE-2026-50663 Overview

CVE-2026-50663 is a relative path traversal vulnerability [CWE-23] in Age of Empires II: Definitive Edition. An unauthorized attacker can exploit the flaw over a network to execute arbitrary code on a victim system. Exploitation requires user interaction, such as joining a multiplayer session or opening attacker-supplied game content. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the affected game client, compromising confidentiality, integrity, and availability of the host.

Affected Products

Age of Empires II: Definitive Edition (Game)
Distributed via Microsoft Store and Steam platforms
Refer to the Microsoft Security Update CVE-2026-50663 advisory for exact fixed build numbers

Discovery Timeline

2026-07-14 - CVE-2026-50663 published to the National Vulnerability Database
2026-07-15 - Last updated in the NVD database

Technical Details for CVE-2026-50663

Vulnerability Analysis

The vulnerability is a relative path traversal weakness classified under [CWE-23]. The game processes file paths supplied through network-delivered content without properly validating parent directory sequences. An attacker can craft input containing ..\ or ../ segments to escape intended directories. This lets the attacker write or reference files at arbitrary locations on the victim host.

Because the traversal is reachable over the network and leads to code execution, the attack surface includes multiplayer sessions, lobby content, mods, replays, and any peer-supplied assets. User interaction is required, meaning a victim must join a session or open attacker-controlled content. The EPSS score is 0.65% with a percentile of 47.1, indicating limited observed exploitation activity at publication.

Root Cause

The root cause is insufficient sanitization of file path components received from remote peers or downloaded content. The game trusts path strings and resolves them relative to game directories without canonicalization or allow-list validation. When traversal sequences are included, the resolved path can point to executable load locations or startup directories.

Attack Vector

Exploitation occurs across the network. An attacker hosts a multiplayer session or distributes crafted game content such as a mod, map, or replay. When the victim joins or loads the content, the vulnerable path parser writes attacker-controlled files outside the intended directory. Placement of an executable payload in a directory loaded by the game or the operating system results in code execution in the victim's user context.

Technical details are limited in the public advisory. See the Microsoft Security Update CVE-2026-50663 advisory for vendor-supplied specifics.

Detection Methods for CVE-2026-50663

Indicators of Compromise

File writes originating from the Age of Empires II: Definitive Edition process to paths outside the game's installation and user data directories
New executable, DLL, or script files appearing in Windows startup folders after a multiplayer session
Unexpected child processes spawned by the game client following network activity

Detection Strategies

Monitor for path strings containing ..\ or ../ sequences within game process file operations
Alert on the game process creating files with executable extensions such as .exe, .dll, .bat, or .ps1 in user-writable auto-run locations
Correlate inbound multiplayer network connections with subsequent anomalous file system activity from the game process

Monitoring Recommendations

Enable process and file system telemetry on hosts where the game is installed
Track modifications to %APPDATA%, %LOCALAPPDATA%, and Startup directories originating from game binaries
Review Windows Defender or third-party EDR logs for blocked writes and process launches associated with the game client

How to Mitigate CVE-2026-50663

Immediate Actions Required

Apply the vendor patch referenced in the Microsoft Security Update CVE-2026-50663 advisory
Restrict multiplayer sessions to trusted peers until the update is deployed
Avoid loading mods, maps, or replays from untrusted sources

Patch Information

Microsoft has issued a security update for Age of Empires II: Definitive Edition. Users should update through the Microsoft Store or Steam client to receive the fixed version. Verify the installed build against the vendor advisory before resuming multiplayer play.

Workarounds

Disable multiplayer functionality until the patched version is installed
Run the game under a standard user account to limit the impact of code execution
Enable application control policies that block execution from user-writable directories such as %APPDATA% and Startup