# CVE-2022-21967 — Xbox Live Auth Manager `XblAuthManagerProxy.dll` Integer Overflow → OOB Write in `ReadStringFromStream`

## Summary
| | |
|---|---|
| **Product** | Windows — `XblAuthManagerProxy.dll` (Xbox Live Auth Manager COM marshaling proxy) |
| **CVE ID** | CVE-2022-21967 |
| **Impact** | Elevation of Privilege |
| **CWE** | CWE-190: Integer Overflow → CWE-787: Out-of-bounds Write |
| **Patch Date** | March 8, 2022 |
| **Pre-patch** | `XblAuthManagerProxy.dll` 10.0.19041.746 |
| **Post-patch** | `XblAuthManagerProxy.dll` 10.0.19041.1586 |
| **Fix gating** | None — bound check added |

## Vulnerability
`XblAuthManagerProxy.dll` implements custom COM marshaling proxies for Xbox Live auth tokens, so a process unmarshals attacker-influenced data. `ReadStringFromStream` reads a client-supplied element **count** from the marshaled stream and computes the byte size as `count * 2` (WCHAR) **without bounding count**. A large count overflows the size used to allocate/copy the string, yielding a **heap out-of-bounds write** in the receiving process (CWE-190 → CWE-787).

## The patch (confirmed — diff)
```c
// ReadStringFromStream (10.0.19041.1586) — PATCHED
if (0x100000 < len) goto error;      // *** bound: len <= 0x100000 before doubling ***
cb = len * 2;
... read ...
if (read_bytes != cb) goto error;    // verify actual read length
```
The count is bounded to `0x100000` before `cb = count*2`, and the actual read length is verified — eliminating the overflow. Unconditional (2022).

## Detection
Crashes in `XblAuthManagerProxy!ReadStringFromStream`; marshaled Xbox Live auth streams carrying implausibly large string counts.

## References
- CVE-2022-21967 · MSRC advisory · Full diff: `/data/patch_diffs/xblauthmanagerproxy_dll-cve-2022-21967-ghidriff.md`