Read the docs
TI-2006-02518 Aliases CVE-2006-2587GHSA-mr9c-6rg6-xq8g

Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229, as…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229, as used by multiple products including (2) America's Army 1.228 and earlier, (3) Battlefield 1942 1.158 and earlier, (4) Battlefield 2 1.184 and earlier, (5) Battlefield Vietnam 1.150 and earlier, (6) Call of Duty 1.173 and earlier, (7) Call of Duty 2 1.108 and earlier, (8) DOOM 3 1.159 and earlier, (9) Enemy Territory 1.167 and earlier, (10) Far Cry 1.150 and earlier, (11) F.E.A.R. 1.093 and earlier, (12) Joint Operations 1.187 and earlier, (13) Quake III Arena 1.150 and earlier, (14) Quake 4 1.181 and earlier, (15) Rainbow Six 3: Raven Shield 1.169 and earlier, (16) Rainbow Six 4: Lockdown 1.093 and earlier, (17) Return to Castle Wolfenstein 1.175 and earlier, and (18) Soldier of Fortune II 1.183 and earlier allows remote attackers to cause a denial of service (application crash) via a long webkey parameter.

Why it matters now

EPSS 0.05108 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:even_balance:punkbuster:1.228:*:servers:*:*:*:*:*1.228VulnerableEven Balance
  • cpe:2.3:a:even_balance:punkbuster:1.228:*:servers:*:*:*:*:* Versions 1.228 Vulnerable ·Even Balance

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-2587
  2. 2026-10-03 Alias added: GHSA-mr9c-6rg6-xq8g

References

Exploit 1

Other 4

  • TI-2006-00749 Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of… CVSS 2.0MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences