What’s Vulnerable › Vulnerabilities

CVE-2020-15007

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-24 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.

Affected products

• Doom Vanille Project Doom Vanille: before 671 — fixed in 671
• Idsoftware Tech 1: all versions

How to fix

Upgrade to a fixed version: Doom Vanille Project Doom Vanille 671. Check the vendor advisory for mitigations.

References

• https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
• https://twitter.com/notrevenant/status/1268654123903340544
• https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
• https://twitter.com/notrevenant/status/1268654123903340544

Get alerted when CVE-2020-15007 or the next vulnerability affects your stack