CVE-2010-2702

Unreal Engine 1, 2, and 2.5 - Remote Code Execution via Long LEVEL Field in WELCOME Response

Title source: llm
STIX 2.1

Description

Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/66039
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40466
Exploit x_refsource_misc
http://aluigi.org/poc/unrealcbof.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/60142

Scores

EPSS 0.0493
EPSS Percentile 91.1%

Details

CWE
CWE-119
Status published
Products (8)
epicgames/postal_2
epicgames/raven_shield
epicgames/swat_4
epicgames/unreal_engine 1
epicgames/unreal_engine 2
epicgames/unreal_engine 2.5
epicgames/unreal_tournament_2003
epicgames/unreal_tournament_2004
Published Jul 12, 2010
Tracked Since Feb 18, 2026