What’s Vulnerable › Vulnerabilities

CVE-2018-20817

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-19 · updated 2026-06-17
• Weakness: CWE-119

Description

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

Affected products

• Activision Call Of Duty: Advanced Warfare: all versions
• Activision Call Of Duty: Black Ops 1: all versions
• Activision Call Of Duty: Blacks Ops 2: all versions
• Activision Call Of Duty: Ghosts: all versions
• Activision Call Of Duty: Modern Warfare 2: all versions
• Activision Call Of Duty: Modern Warfare 3: all versions

References

• https://github.com/RektInator/cod-steamauth-rce
• https://github.com/momo5502/cod-exploits/tree/master/steam-auth
• https://github.com/RektInator/cod-steamauth-rce
• https://github.com/momo5502/cod-exploits/tree/master/steam-auth

Get alerted when CVE-2018-20817 or the next vulnerability affects your stack