Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games
Critical
V
Valve
Submitted None
Team Summary
Official summary from Valve
With a specially crafted closed captions file, the parser calls CHudCloseCaption::GetNoRepeatValue which in turn calls CHudCloseCaption::SplitCommand which has no boundary checks allowing the on stack variables cmd and args to be overflowed which in turn allows Remote Code Execution.
Actions:
Reported by
gamer7112
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$7500.00
Submitted
Weakness
Classic Buffer Overflow