Microsoft patches critical remote code execution flaw in Age of Empires II
The vulnerability, identified as CVE-2026-50663, allowed attackers to gain control of a user’s computer via a malicious game invite. Cybersecurity firm Rapid7 warns of potential password theft, though no evidence of live exploitation has been found.
Microsoft has released a security patch for the remastered version of the classic strategy video game Age of Empires II, addressing a critical remote code execution vulnerability. The flaw, identified as CVE-2026-50663, enabled attackers to take control of a victim’s computer by sending a custom malicious game invite. The patch was issued on Tuesday as part of the company’s monthly security update cycle, which this month addressed a historic record number of security bugs across its product lines.
The discovery of this vulnerability was assisted by artificial intelligence tools, marking a significant shift in how software defects are identified. Microsoft utilised AI to help the company and external researchers discover bugs during the current update cycle, a strategy that contributed to the unprecedented volume of fixes released this month.
Security researchers identified the specific mechanism of the exploit, which could be triggered by joining an attacker’s lobby and auto-accepting a user-generated content invite. A video demonstration posted on X illustrates how the flaw allows for remote code execution, showing the technical steps required to compromise a system.
Cybersecurity firm Rapid7 confirmed that a successful attack would allow hackers to place malicious files on the victim’s machine. This access could lead to the ability to run arbitrary code, effectively granting the attacker full control over the compromised computer. Rapid7 noted that such access could facilitate further malicious activities, including the theft of passwords.
While targeting video gamers is a known tactic for malware distribution due to the potential to infect a high volume of devices, there is currently no evidence that this specific bug was successfully exploited in the wild prior to the patch. The original Age of Empires II was released 25 years ago, and its remastered version continues to attract a dedicated player base.
Microsoft’s Patch Tuesday update cycle remains a critical component of its security infrastructure, with this month’s release standing out for the sheer number of vulnerabilities addressed. The integration of AI in the discovery process suggests a growing reliance on automated tools to manage the expanding attack surface of complex software ecosystems.
