A rogue multiplayer lobby drops files anywhere it wants on your gamer's laptop
CVE-2026-50663 is a relative path traversal (CWE-23) in the User Generated Content (UCG) sync path of Age of Empires II: Definitive Edition. When a player joins a multiplayer lobby, the client auto-downloads scenario/mod payloads from the host; the archive extractor doesn't sanitize ..\ sequences, so the host can write arbitrary files to arbitrary locations under the player's user context. Combined with a startup or DLL-search-order write, that becomes user-level RCE. Affected: all AoE2:DE builds prior to 101.103.46651.0, delivered via Steam and the Microsoft Store.
Microsoft's 8.8 HIGH is fair for the *class* of bug — network-reachable, unauthenticated-from-the-attacker's-side, RCE with only UI:R (accept the lobby). But applied to an enterprise fleet, the vendor score dramatically overstates operational risk. This binary should not exist on a corporate endpoint at all; where it does, the blast radius is a single user account on a workstation, not a server role. That gap between raw CVSS and enterprise reality is the whole point of reassessing.
4 steps from start to impact.
Attacker hosts a poisoned multiplayer lobby
..\..\ traversal sequences. Public PoC posted by researcher Rick de Jager (@rdjgr) on X demonstrates the trigger. Tooling: modified AoE2:DE client + custom scenario archive.- Attacker has a Steam/Xbox Live account and can host a public lobby
- Victim runs vulnerable AoE2:DE build < 101.103.46651.0
- Enterprise endpoints rarely have AoE2:DE installed at all
- Steam/MS Store install typically blocked by app allowlists on managed devices
Victim joins the lobby, UCG auto-accepts
- Victim discovers or is directed to the attacker lobby
- UCG auto-accept is enabled (default)
- Requires social direction to the specific lobby, or lobby-browser roulette
- Users playing games on corporate laptops is a policy problem, not a majority behavior
Path traversal writes arbitrary files as the user
..\ in archive entries, allowing writes to %APPDATA%, %LOCALAPPDATA%\Microsoft\WindowsApps, Startup folders, or DLL search-order locations next to the game binary. The attacker drops a payload or hijacks a load path.- Extractor runs with the user's token, which has write access to per-user autoruns and app dirs
- ASR rules blocking writes to Startup / Run keys stop the persistence variant
- AppLocker / WDAC in enforce mode blocks the DLL sideload variant
%LOCALAPPDATA% DLLs adjacent to RelicCardinal.exe is a solid indicator.Code executes in the user context on next trigger
- User logs back in or relaunches the game
- Modern EDR (Defender for Endpoint, CrowdStrike, SentinelOne) will catch commodity payloads at execution
- Chain terminates at user-mode; no built-in EoP
RelicCardinal.exe or Startup-launched binaries.- Perimeter WAF / IPS — the exploit rides Steam's own transport to the game client; nothing hits your web perimeter.
- Email gateway filtering — no email vector; the lure is a Steam lobby invite, not an attachment.
- MFA on corporate SSO — irrelevant; the attacker never touches identity infrastructure.
- Network segmentation of servers — the affected component is a client-side game, not a server.
The supporting signals.
| In-the-wild exploitation | None observed as of 2026-07-16 per MSRC; not on CISA KEV. |
|---|---|
| Public PoC | Demonstration video by Rick de Jager (@rdjgr) on X, 2026-07-15. No weaponized repo yet. |
| EPSS | 0.0065 (~0.65%) — low predicted 30-day exploitation probability, consistent with niche client-side scope. |
| KEV status | Not listed. No CISA due date. |
| CVSS vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-reachable, requires one victim click, high impact on the single host. |
| Affected versions | All AoE2:DE builds < 101.103.46651.0 (Steam app 813780, MS Store equivalent). |
| Fixed version | 101.103.46651.0, pushed via Steam / Microsoft Store auto-update on 2026-07-14. |
| Exposure population | AoE2:DE has ~40k concurrent Steam players; effectively zero on corporate/production endpoints in most enterprises. |
| Disclosure | 2026-07-14 MSRC advisory, coordinated with the game studio (World's Edge / Forgotten Empires). |
| Reporter | Credit per MSRC: Rick de Jager. |
Sources.
Why this verdict
- Population floor: AoE2:DE is a consumer title distributed via Steam / MS Store. On a hardened enterprise image with app allowlisting, install rate is ~0%. Even on permissive BYOD, it's a rounding error.
- Role multiplier — low-value only: The affected component runs in user mode on end-user workstations. There is no plausible high-value deployment role — no server, no hypervisor, no identity, no CI/CD, no kernel driver. Blast radius is bounded at the single user token on one host.
- UI:R is a real gate: Victim must actively join the attacker's specific lobby. This is not a drive-by, not an email lure, not a wormable propagation. Attacker needs to social-engineer target players individually.
- No lateral primitive: Chain lands as the user, not SYSTEM. No built-in EoP, no credential material by default, no domain trust abuse.
Why not higher?
HIGH would be justified if AoE2:DE were a plausible enterprise component or if there were a wormable propagation (like a matchmaking-service push). Neither is true. The vendor's 8.8 is technically correct for the bug class but blind to the deployment reality that decides enterprise risk.
Why not lower?
Not LOW/IGNORE because a working RCE chain does exist, the PoC is public, and shadow IT / BYOD / dev-laptop populations do carry Steam installs. If a red team spots the game in your inventory, they will use it as an initial-access primer on that specific user.
Crowdsourced verification payload.
Run on each Windows endpoint (or via your RMM / Intune / MECM script deployment) as the logged-in user — the game installs per-user through Steam / MS Store. No admin required to detect; admin required to remediate an install. Example: powershell -ExecutionPolicy Bypass -File Check-AoE2DE.ps1.
#requires -Version 5.1
# Check-AoE2DE.ps1 — Detect AoE2:DE builds vulnerable to CVE-2026-50663
# Fixed build: 101.103.46651.0
# Exit codes: 0 = PATCHED / not installed, 1 = VULNERABLE, 2 = UNKNOWN
$FixedVersion = [Version]'101.103.46651.0'
$found = $false
$vulnerable = $false
$unknown = $false
function Compare-Build {
param([string]$VerString, [string]$SourceLabel)
try {
$v = [Version]$VerString
if ($v -lt $script:FixedVersion) {
Write-Host "VULNERABLE [$SourceLabel] AoE2:DE build $v (< 101.103.46651.0)"
$script:vulnerable = $true
} else {
Write-Host "PATCHED [$SourceLabel] AoE2:DE build $v"
}
} catch {
Write-Host "UNKNOWN [$SourceLabel] cannot parse '$VerString'"
$script:unknown = $true
}
}
# 1. Steam install — read appmanifest_813780.acf
$steamRoots = @()
try {
$steamPath = (Get-ItemProperty 'HKCU:\Software\Valve\Steam' -ErrorAction Stop).SteamPath
if ($steamPath) { $steamRoots += $steamPath }
} catch {}
foreach ($root in $steamRoots) {
$manifest = Join-Path $root 'steamapps\appmanifest_813780.acf'
if (Test-Path $manifest) {
$found = $true
$exe = Get-ChildItem -Path (Join-Path $root 'steamapps\common\AoE2DE') -Filter 'AoE2DE_s.exe' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
if ($exe) {
Compare-Build -VerString $exe.VersionInfo.ProductVersion -SourceLabel 'Steam'
} else {
Write-Host "UNKNOWN [Steam] manifest present but AoE2DE_s.exe not located"
$unknown = $true
}
}
}
# 2. Microsoft Store install
try {
$pkg = Get-AppxPackage -Name 'Microsoft.MSDallas_8wekyb3d8bbwe' -ErrorAction SilentlyContinue
if ($pkg) {
$found = $true
Compare-Build -VerString $pkg.Version -SourceLabel 'MSStore'
}
} catch {}
if (-not $found) {
Write-Host 'PATCHED AoE2:DE not installed on this host'
exit 0
}
if ($vulnerable) { exit 1 }
if ($unknown) { exit 2 }
exit 0