CVE-2025-54065

GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling allows scripts to read arbitrary addresses, write constants into the JIT-compiled code section, and redirect control flow through crafted FState and VMFunction structures. A script can copy FState structures into a writable buffer, modify function pointers and state transitions, and cause execution of attacker-controlled bytecode, leading to arbitrary code execution.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ZDoom/gzdoom/security/advisories/GHSA-prhc-chfw-32jg

Configurations

No configuration.

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) GZDoom es un puerto centrado en características para todos los juegos con motor Doom. GZDoom es un motor Doom de código abierto. En las versiones 4.14.2 y anteriores, el manejo del estado de los actores de ZScript permite a los scripts leer direcciones arbitrarias, escribir constantes en la sección de código compilado JIT y redirigir el flujo de control a través de estructuras FState y VMFunction manipuladas. Un script puede copiar estructuras FState en un búfer escribible, modificar punteros de función y transiciones de estado, y provocar la ejecución de bytecode controlado por el atacante, lo que lleva a la ejecución de código arbitrario.

Information

Published : 2025-12-03 17:15

Updated : 2026-10-18 17:10

NVD link : CVE-2025-54065

Mitre link : CVE-2025-54065

CVE.ORG link : CVE-2025-54065

JSON object : View

Products Affected

No product.

CWE

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2025-54065", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54065", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T21:39:32.116409Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZDoom", "product": "gzdoom", "versions": [{"status": "affected", "version": "<= 4.14.2"}]}]}], "published": "2025-12-03T17:15:52.170", "references": [{"url": "https://github.com/ZDoom/gzdoom/security/advisories/GHSA-prhc-chfw-32jg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling allows scripts to read arbitrary addresses, write constants into the JIT-compiled code section, and redirect control flow through crafted FState and VMFunction structures. A script can copy FState structures into a writable buffer, modify function pointers and state transitions, and cause execution of attacker-controlled bytecode, leading to arbitrary code execution."}, {"lang": "es", "value": "GZDoom es un puerto centrado en caracter\u00edsticas para todos los juegos con motor Doom. GZDoom es un motor Doom de c\u00f3digo abierto. En las versiones 4.14.2 y anteriores, el manejo del estado de los actores de ZScript permite a los scripts leer direcciones arbitrarias, escribir constantes en la secci\u00f3n de c\u00f3digo compilado JIT y redirigir el flujo de control a trav\u00e9s de estructuras FState y VMFunction manipuladas. Un script puede copiar estructuras FState en un b\u00fafer escribible, modificar punteros de funci\u00f3n y transiciones de estado, y provocar la ejecuci\u00f3n de bytecode controlado por el atacante, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "lastModified": "2026-10-18T17:10:00.110", "sourceIdentifier": "security-advisories@github.com"}