Age of Empires II bug let hackers hijack PCs via game invites

Key Takeaways

• Microsoft patched a critical RCE vulnerability (CVE-2026-50663) in Age of Empires II that allowed full system takeover via malicious game invites
• The July 2026 Patch Tuesday set a record for security fixes, with AI helping researchers discover vulnerabilities faster
• No evidence the bug was exploited in the wild, but gamers remain high-value targets for credential theft and crypto malware

Microsoft patched a remote code execution flaw in Age of Empires II: Definitive Edition that allowed attackers to take over a victim's computer simply by sending them a malicious game invite. The fix arrived in Tuesday's Patch Tuesday release, which set a historic record for the number of security bugs addressed across Microsoft's product lines.

The vulnerability, tracked as CVE-2026-50663, worked through the game's user-generated content system. A player who joined an attacker's multiplayer lobby and accepted UGC would unknowingly trigger remote code execution on their machine. Security researcher Rick de Jager posted a proof-of-concept video on X demonstrating the attack chain.

How the exploit worked

According to cybersecurity firm Rapid7, successful exploitation placed malicious files on the victim's system, giving the attacker the ability to run arbitrary code. That means full control of the compromised computer: access to files, credentials, browser sessions, anything stored locally.

The attack required minimal user interaction. The victim only needed to join a multiplayer lobby controlled by the attacker and accept the auto-prompted UGC content. No suspicious downloads, no obviously malicious links. Just an ordinary-looking game invite.

Why gamers are high-value targets

Microsoft says there's no evidence CVE-2026-50663 was exploited in the wild before the patch. But the gaming community remains a lucrative target for attackers. Gamers tend to have powerful hardware useful for cryptomining, store payment credentials in multiple accounts, and often run software with elevated permissions for performance reasons.

This isn't theoretical. The FBI recently arrested a man accused of using Steam games to drain victims' cryptocurrency wallets. UK police disrupted a hacking group that reportedly targeted gaming platforms. The pattern is clear: games with active multiplayer communities and UGC features create attack surface that criminals will probe.

AI accelerates vulnerability discovery

Microsoft attributed the record-breaking patch count partly to AI-assisted bug hunting. Both internal teams and external researchers are using machine learning to identify vulnerabilities faster than manual code review allows. The Age of Empires II flaw sat in a 25-year-old codebase. The Definitive Edition shipped in 2019, meaning the vulnerable code persisted for years before anyone caught it.

This creates an uncomfortable reality for security teams. AI tools lower the barrier for finding bugs, which benefits defenders and attackers equally. The time between vulnerability discovery and weaponization shrinks when both sides have access to the same acceleration technology.

What players should do now

If you play Age of Empires II: Definitive Edition, update immediately. The patch is available through Steam and the Microsoft Store. Xbox Game Pass users should see the update applied automatically, but verify by checking the game's version number in the launcher.

For enterprises allowing gaming on corporate machines, or IT admins managing devices used by family members, this is a reminder that games carry real security risk. They run with substantial system access, connect to untrusted peers over the network, and process user-generated content. Treat them like any other networked application in your threat model.

Frequently Asked Questions

Was the Age of Empires II vulnerability exploited by hackers?

No. Microsoft and security researchers found no evidence that CVE-2026-50663 was exploited in the wild before the patch was released.

How do I update Age of Empires II to fix the security flaw?

The patch is available through Steam and the Microsoft Store. Launch your game client, check for updates, and install the latest version. Xbox Game Pass users typically receive automatic updates.

What is remote code execution and why is it dangerous?

Remote code execution (RCE) allows an attacker to run arbitrary commands on your computer from a remote location. This gives them full control of your system, including access to files, credentials, and the ability to install malware.

Why are video games targeted by hackers?

Gamers often have powerful hardware, store payment credentials across multiple platforms, and run games with elevated system permissions. Games with multiplayer and user-generated content features also create network attack surfaces that criminals can exploit.

Source: TechCrunch / Lorenzo Franceschi-Bicchierai