EIP-2026-118627

The entry describes a format string vulnerability in Half-Life clients where an invalid command with format specifiers triggers arbitrary code execution when the error response is displayed. The vulnerability stems from improper handling of user-controlled input in error messages.