CVE-2026-55010: what Bedrock server admins actually need to do

What it is

CVE-2026-55010 is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, confirmed via the National Vulnerability Database. The official description: "Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network."

That is remote code execution, not a crash bug. An attacker who successfully exploits it does not just take the server down, they run code of their own choosing on the machine it is running on.

Why the severity rating is what it is

CVSS 9.8, Critical. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which breaks down to:

• Network-exploitable (AV:N): reachable over the internet, not just on a local network.
• Low complexity (AC:L): no unusual conditions or timing have to line up for it to work.
• No privileges required (PR:N): the attacker does not need an account or any prior access.
• No user interaction (UI:N): nobody on the server side has to click anything, run anything, or be tricked into anything.
• High confidentiality, integrity and availability impact (C:H/I:H/A:H): a successful exploit can read data, change it, and take the service down, all three.

Put plainly: any Bedrock Dedicated Server reachable from the internet is a target by default, with nothing the operator has to get wrong first.

What Microsoft's own patch data actually says, and why it's worth being careful here

Microsoft's July 2026 Patch Tuesday release marks this CVE "Action Required: No". That label is normally used for cloud services Microsoft operates and patches on its own infrastructure, where there is genuinely nothing for a customer to do.

Bedrock Dedicated Server does not fit that category cleanly. It is not a hosted service; it is software an admin downloads and runs on their own machine, the same shape as a Java server jar. A "no action required" label makes clean sense for something like a cloud API. For self-hosted server software, it more plausibly means the fix shipped inside the current official server download, rather than as a discrete patch an admin has to specifically go find. That is a real difference in what it implies for someone running an OLDER download that has not been refreshed.

This site is not going to state a confident answer it cannot verify. What it will say plainly: update to the current official Bedrock Dedicated Server build. That is correct regardless of which of these explanations is true. If the fix is already in the current download, this puts you on it. If somehow it is not, this is still the right first move for any critical RCE advisory, full stop.

What to actually do

1. Update Bedrock Dedicated Server to the current official build, from the same place you originally downloaded it. This is the action that matters regardless of the classification question above.
2. Back up first. Backing up before updating covers what to save and why, and it is worth doing before any server-software update, not just a security one.
3. If you cannot update immediately, and the server does not need to be reachable from the open internet right now, restrict inbound access at the firewall or router until you can. A server that is not reachable is not exploitable by a network-based flaw like this one.
4. Java Edition servers are not implicated. If you run vanilla, Paper, or a Paper fork, this specific CVE does not name your software. It is still good practice to stay current regardless.

What this is not

This is not a Java Edition vulnerability, not a client-side vulnerability, and not something that requires a player to do anything on their end. It is specific to the server binary that an admin runs to host a Bedrock world for others to join. If you are a player rather than a server operator, there is nothing here that applies to you directly, beyond the servers you choose to join being run by operators who keep their software current.