CVE-2026-55010: What Self-Hosted Bedrock Server Operators Can Verify

CVE-2026-55010 describes a critical remote-code-execution vulnerability associated with Minecraft Bedrock Dedicated Server. The cited records, however, do not identify an affected or fixed build of the downloadable server software.

What the CVE record establishes

The NVD entry describes a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. It displays Microsoft’s CVSS 3.1 base score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The entry is tagged exclusively-hosted-service. Its affected-product data names Microsoft Minecraft Bedrock Dedicated Server, but the affected-version field contains - rather than a release or build number.

Why self-hosted scope remains unclear

The CVE CNA Operational Rules require the exclusively-hosted-service tag when all known products listed in a CVE record exist only as fully hosted services. The rules prohibit that tag when a vulnerability affects both hosted services and on-premises products.

Minecraft’s official Bedrock server page documents Windows and Linux versions of Bedrock Dedicated Server, including requirements for Windows 10, Windows Server, and Ubuntu.

Taken together, the tag, product name, and - version value do not establish whether any particular downloadable Bedrock Dedicated Server build is affected or unaffected. A product-specific version boundary would be needed to make that determination from the cited records.

CrowdStrike’s July 2026 Patch Tuesday analysis lists CVE-2026-55010 with “Action Required?” set to “No,” but it does not identify an affected or fixed downloadable-server build. That secondary assessment therefore does not resolve the self-hosted scope question.