CVE-2024-54756
Published: 20 February 2025
Summary
CVE-2024-54756 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-54756 is a remote code execution (RCE) vulnerability affecting the ZScript function in ZDoom Team GZDoom version 4.13.1. The flaw allows attackers to execute arbitrary code by supplying a crafted PK3 file that contains a malicious ZScript source file. It has been assigned a CVSS v3.1 base score of 9.8, indicating critical severity, and is associated with CWE-94 (Improper Control of Generation of Code).
The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U). Any unauthenticated attacker can leverage this by delivering the malicious PK3 file, potentially gaining full control over the affected GZDoom instance.
References include a proof-of-concept (PoC) exploit at https://github.com/Chainmanner/GZDoom-Arbitrary-Code-Execution-via-ZScript-PoC and disclosures on the Full Disclosure mailing list at https://seclists.org/fulldisclosure/2025/Feb/11 and http://seclists.org/fulldisclosure/2025/Feb/11. No specific patch or mitigation details are detailed in the provided CVE information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4457
Vulnerability details
A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via crafted input directly enables remote exploitation of a public-facing app (T1190) and arbitrary command/script execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires organizations to identify, report, and correct flaws like the ZScript RCE in GZDoom, directly preventing exploitation through timely patching.
SI-3 mandates malicious code protection mechanisms that scan and block crafted PK3 files containing malicious ZScript before execution.
SI-10 enforces validation of information inputs such as PK3 file contents to prevent improper control of code generation leading to RCE via malicious ZScript.