CVE-2021-33879

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-06 · updated 2026-06-17
Weakness: CWE-494

Description

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file's MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim's machine.

Affected products

Tencent Gameloop: before 4.1.21.90 — fixed in 4.1.21.90

How to fix

Upgrade to a fixed version: Tencent Gameloop 4.1.21.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-33879 or the next vulnerability affects your stack