CVE-2019-15943
vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset call.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 8.72% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- valvesoftware/counter-strike\
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/154705/Counter-Strike-Global-Offensive-Code-Execution-Denial-Of-Service.html
- https://blog.counter-strike.net/index.php/category/updates/Release Notes
- https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/README.mdExploit, Third Party Advisory
- http://packetstormsecurity.com/files/154705/Counter-Strike-Global-Offensive-Code-Execution-Denial-Of-Service.html
- https://blog.counter-strike.net/index.php/category/updates/Release Notes
- https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/README.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.