Relative path traversal in Age of Empires II: Definitive Edition Game

CVE-2026-50663 is a relative path traversal (CWE-23) in the User Generated Content (UCG) sync path of Age of Empires II: Definitive Edition. When a player joins a multiplayer lobby, the client auto-downloads scenario/mod payloads from the host; the archive extractor doesn't sanitize ..\ sequences, so the host can write arbitrary files to arbitrary locations under the player's user context. Combined with a startup or DLL-search-order write, that becomes user-level RCE. Affected: all AoE2:DE builds prior to 101.103.46651.0, delivered via Steam and the Microsoft Store.

Microsoft's 8.8 HIGH is fair for the *class* of bug — network-reachable, unauthenticated-from-the-attacker's-side, RCE with only UI:R (accept the lobby). But applied to an enterprise fleet, the vendor score dramatically overstates operational risk. This binary should not exist on a corporate endpoint at all; where it does, the blast radius is a single user account on a workstation, not a server role. That gap between raw CVSS and enterprise reality is the whole point of reassessing.

Why this verdict

• Population floor: AoE2:DE is a consumer title distributed via Steam / MS Store. On a hardened enterprise image with app allowlisting, install rate is ~0%. Even on permissive BYOD, it's a rounding error.
• Role multiplier — low-value only: The affected component runs in user mode on end-user workstations. There is no plausible high-value deployment role — no server, no hypervisor, no identity, no CI/CD, no kernel driver. Blast radius is bounded at the single user token on one host.
• UI:R is a real gate: Victim must actively join the attacker's specific lobby. This is not a drive-by, not an email lure, not a wormable propagation. Attacker needs to social-engineer target players individually.
• No lateral primitive: Chain lands as the user, not SYSTEM. No built-in EoP, no credential material by default, no domain trust abuse.

Why not higher?

HIGH would be justified if AoE2:DE were a plausible enterprise component or if there were a wormable propagation (like a matchmaking-service push). Neither is true. The vendor's 8.8 is technically correct for the bug class but blind to the deployment reality that decides enterprise risk.

Why not lower?

Not LOW/IGNORE because a working RCE chain does exist, the PoC is public, and shadow IT / BYOD / dev-laptop populations do carry Steam installs. If a red team spots the game in your inventory, they will use it as an initial-access primer on that specific user.

1. Block AoE2:DE from managed endpoints via AppLocker / WDAC / Intune — Enforce an application allowlist that excludes Steam app 813780 and the MS Store SKU. No mitigation SLA for MEDIUM under the noisgate policy — implement as part of routine allowlist maintenance.
2. Force Steam / MS Store auto-update where the game is permitted — For dev / creative / BYOD populations where the game is legitimately installed, ensure Steam auto-update and MS Store update policy are enabled so 101.103.46651.0 rolls out automatically.
3. Enable ASR rule 'Block persistence through WMI event subscription' and Startup-folder write monitoring — Catches the persistence stage of this and similar user-mode traversal-to-RCE chains. Deploy alongside other Defender ASR rules already in your baseline.
4. Inventory Steam / MS Store gaming apps across the fleet — Use Intune / MECM / your EDR's software inventory to identify hosts with AoE2:DE installed. This gives you an accurate exposure number rather than assuming zero.

Run on each Windows endpoint (or via your RMM / Intune / MECM script deployment) as the logged-in user — the game installs per-user through Steam / MS Store. No admin required to detect; admin required to remediate an install. Example: powershell -ExecutionPolicy Bypass -File Check-AoE2DE.ps1.

#requires -Version 5.1
# Check-AoE2DE.ps1 — Detect AoE2:DE builds vulnerable to CVE-2026-50663
# Fixed build: 101.103.46651.0
# Exit codes: 0 = PATCHED / not installed, 1 = VULNERABLE, 2 = UNKNOWN

$FixedVersion = [Version]'101.103.46651.0'
$found = $false
$vulnerable = $false
$unknown = $false

function Compare-Build {
    param([string]$VerString, [string]$SourceLabel)
    try {
        $v = [Version]$VerString
        if ($v -lt $script:FixedVersion) {
            Write-Host "VULNERABLE [$SourceLabel] AoE2:DE build $v (< 101.103.46651.0)"
            $script:vulnerable = $true
        } else {
            Write-Host "PATCHED    [$SourceLabel] AoE2:DE build $v"
        }
    } catch {
        Write-Host "UNKNOWN    [$SourceLabel] cannot parse '$VerString'"
        $script:unknown = $true
    }
}

# 1. Steam install — read appmanifest_813780.acf
$steamRoots = @()
try {
    $steamPath = (Get-ItemProperty 'HKCU:\Software\Valve\Steam' -ErrorAction Stop).SteamPath
    if ($steamPath) { $steamRoots += $steamPath }
} catch {}
foreach ($root in $steamRoots) {
    $manifest = Join-Path $root 'steamapps\appmanifest_813780.acf'
    if (Test-Path $manifest) {
        $found = $true
        $exe = Get-ChildItem -Path (Join-Path $root 'steamapps\common\AoE2DE') -Filter 'AoE2DE_s.exe' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
        if ($exe) {
            Compare-Build -VerString $exe.VersionInfo.ProductVersion -SourceLabel 'Steam'
        } else {
            Write-Host "UNKNOWN    [Steam] manifest present but AoE2DE_s.exe not located"
            $unknown = $true
        }
    }
}

# 2. Microsoft Store install
try {
    $pkg = Get-AppxPackage -Name 'Microsoft.MSDallas_8wekyb3d8bbwe' -ErrorAction SilentlyContinue
    if ($pkg) {
        $found = $true
        Compare-Build -VerString $pkg.Version -SourceLabel 'MSStore'
    }
} catch {}

if (-not $found) {
    Write-Host 'PATCHED    AoE2:DE not installed on this host'
    exit 0
}
if ($vulnerable) { exit 1 }
if ($unknown)    { exit 2 }
exit 0

Sources

1. MSRC advisory CVE-2026-50663
2. NVD entry CVE-2026-50663
3. Rick de Jager PoC demonstration (X)
4. Windows Forum — fix and update guidance
5. Windows News coverage
6. Zamin.uz coverage
7. Age of Empires Support portal