Description

A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file.

Classification

CVE ID: CVE-2024-54756

Affected Products

Vendor: n/a

Product: n/a

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.1% (probability of being exploited)

EPSS Percentile: 24.69% (scored less or equal to compared to others)

EPSS Date: 2025-03-21 (when was this score calculated)

References

https://github.com/Chainmanner/GZDoom-Arbitrary-Code-Execution-via-ZScript-PoC
https://seclists.org/fulldisclosure/2025/Feb/11

Timeline