CVE-2018-20817

SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

• CWE-119

• https://github.com/RektInator/cod-steamauth-rceExploit, Third Party Advisory
• https://github.com/momo5502/cod-exploits/tree/master/steam-authThird Party Advisory
• https://github.com/RektInator/cod-steamauth-rceExploit, Third Party Advisory
• https://github.com/momo5502/cod-exploits/tree/master/steam-authThird Party Advisory

Published

Apr 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20811A hidden RPC service issue was found with Pulse Secure Pulse…
• CVE-2018-20812An information exposure issue where IPv6 DNS traffic would b…
• CVE-2018-20813An input validation issue has been found with login_meeting.…
• CVE-2018-20814An XSS issue was found with Psaldownload.cgi in Pulse Secure…
• CVE-2018-20815In QEMU 3.1.0, load_device_tree in device_tree.c calls the d…
• CVE-2018-20816An XSS combined with CSRF vulnerability discovered in SalesA…
• CVE-2018-20818A buffer overflow vulnerability was discovered in the OpenPL…
• CVE-2018-20819io/ZlibCompression.cc in the decompression component in Drop…
• CVE-2018-2082Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20820read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows atta…
• CVE-2018-20821The parsing component in LibSass through 3.5.5 allows attack…6.5
• CVE-2018-20822LibSass 3.5.4 allows attackers to cause a denial-of-service …6.5