Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M
CVE-2025-54065GZDoom engine allows arbitrary code execution via ZScript actor states
High 7.8
In plain English
A high-severity security flaw in gzdoom from ZDoom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling allows scripts to read arbitrary addresses, write constants into the JIT-compiled code section, and redirect control flow through crafted FState and VMFunction structures. A script can copy FState structures into a writable buffer, modify function pointers and state transitions, and cause execution of attacker-controlled bytecode, leading to arbitrary code execution.
Affected products (as reported)
Weakness: CWE-913 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/ZDoom/gzdoom/security/advisories/GHSA-prhc-chfw-32jg x_refsource_CONFIRM