CVE-2020-15007

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ecPatch, Third Party Advisory
https://twitter.com/notrevenant/status/1268654123903340544Third Party Advisory
https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ecPatch, Third Party Advisory
https://twitter.com/notrevenant/status/1268654123903340544Third Party Advisory

Timeline

Published: Jun 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150087.5A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation t CVE-2020-150097.8AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (CVE-2020-15015.4A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S CVE-2020-150114.3GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.CVE-2020-150128.6A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can CVE-2020-150148.8pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF.CVE-2020-150156.1The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.CVE-2020-150166.1NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exp CVE-2020-150176.1NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can expl CVE-2020-150186.5playSMS through 1.4.3 is vulnerable to session fixation.CVE-2020-15025.5An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploite CVE-2020-150205.4An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name