The Core::Receive function in neonet/core.cpp for NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service (engine crash) via a message with a large uiMessageLength that produces a failed memory allocation and a null pointer dereference.

Threat-Mapped Scoring

Score: 1.5

Priority: P4 - Informational (Low)

• S10 – Denial of Service

EPSS

Score: 0.01066
Percentile: 0.76736

CVSS Scoring

Affected Products

• cpe:2.3:a:neoengine:neoengine:0.8.2:*:*:*:*:*:*:*

← Back to Home