CVE-2004-0608

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 73.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-06 · updated 2026-06-16

Description

The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.

Affected products

Arush Devastation: 390.0
Dreamforge Tnn Outdoors Pro Hunter: all versions
Epic Games Unreal Engine: 226f, 433, 436
Epic Games Unreal Tournament: 451b
Epic Games Unreal Tournament 2003: 2199_linux, 2199_macos, 2199_win32, 2225_macos, 2225_win32
Epic Games Unreal Tournament 2004: macos, win32
gentoo Linux: 1.4
Infogrames Tacticalops: 3.4
Infogrames X-Com Enforcer: all versions
Ion Storm Deusex: 1.112_fm
Nerf Arena Blast: 1.2
Rage Software Mobile Forces: 20000.0
Robert Jordan Wheel Of Time: 333.0b
Running With Scissors Postal 2: 1337

References

Get alerted when CVE-2004-0608 or the next vulnerability affects your stack