CVE-2003-1432: epic games unreal engine Code Injection
Vulnerability summary
CVE-2003-1432 is a high (CVSS 10.0) Code Injection vulnerability in epic games unreal engine. EPSS estimates a 7.54% chance of exploitation in the next 30 days, higher than 94.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 23-10-2007PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via (1) a packet with a negative size value, which is treated as a large positive number during memory allocation, or (2) a negative size value in a package file.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
7.54%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.
Affected systems
Epic games1 product
- unreal engine226f | 433 | 436
Epic_games1 product
- unreal_tournament_20032199_linux | 2199_win32 | demo_version_2206_linux | demo_version_2206_win32
2 vendors · 2 products