Read the docs
TI-2018-14788 Aliases CVE-2018-20817GHSA-jphr-rfwm-72w3

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before…

Priority MEDIUM 49CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

Why it matters now

EPSS 0.03785 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:activision:call_of_duty\:_advanced_warfare:-:*:*:*:*:*:*:*_advanced_warfareVulnerableActivision
cpe:2.3:a:activision:call_of_duty\:_black_ops_1:-:*:*:*:*:*:*:*_black_ops_1VulnerableActivision
cpe:2.3:a:activision:call_of_duty\:_blacks_ops_2:-:*:*:*:*:*:*:*_blacks_ops_2VulnerableActivision
cpe:2.3:a:activision:call_of_duty\:_ghosts:-:*:*:*:*:*:*:*_ghostsVulnerableActivision
cpe:2.3:a:activision:call_of_duty\:_modern_warfare_2:-:*:*:*:*:*:*:*_modern_warfare_2VulnerableActivision
cpe:2.3:a:activision:call_of_duty\:_modern_warfare_3:-:*:*:*:*:*:*:*_modern_warfare_3VulnerableActivision
  • cpe:2.3:a:activision:call_of_duty\:_advanced_warfare:-:*:*:*:*:*:*:* Versions _advanced_warfare Vulnerable ·Activision
  • cpe:2.3:a:activision:call_of_duty\:_black_ops_1:-:*:*:*:*:*:*:* Versions _black_ops_1 Vulnerable ·Activision
  • cpe:2.3:a:activision:call_of_duty\:_blacks_ops_2:-:*:*:*:*:*:*:* Versions _blacks_ops_2 Vulnerable ·Activision
  • cpe:2.3:a:activision:call_of_duty\:_ghosts:-:*:*:*:*:*:*:* Versions _ghosts Vulnerable ·Activision
  • cpe:2.3:a:activision:call_of_duty\:_modern_warfare_2:-:*:*:*:*:*:*:* Versions _modern_warfare_2 Vulnerable ·Activision
  • cpe:2.3:a:activision:call_of_duty\:_modern_warfare_3:-:*:*:*:*:*:*:* Versions _modern_warfare_3 Vulnerable ·Activision

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20817
  2. 2026-10-03 Alias added: GHSA-jphr-rfwm-72w3
  3. 2026-11-05 EPSS moved to the 90th–95th percentile

References

Exploit 1

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences