PT-2020-14075 · Freedroidrpg Team+1 · Freedroidrpg+1

Michał Dardas · Published 2020-06-23 · Updated 2025-07-28 · CVE-2020-14938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreedroidRPG version 1.0rc2

Description The issue arises from the assumption of data set lengths read from saved game files in map.c. It leads to a heap-based buffer overflow due to the lack of size verification when copying data from a file into a fixed-size heap-allocated buffer.

Recommendations For FreedroidRPG version 1.0rc2, consider restricting access to saved game files to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the affected map.c functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-14938

Affected Products

Debian

Freedroidrpg

References · 14

• 🔥 https://bugs.freedroid.org/b/issue951 · Exploit
• 🔥 https://logicaltrust.net/blog/2020/02/freedroid.html · Exploit
• https://cve.org/CVERecord?id=CVE-2020-14938 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-14938 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14938 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14938 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14938 · Vendor Advisory
• https://t.me/cvenotify/4588 · Telegram Post
• https://twitter.com/GuidedHacking/status/1949935989788471550 · Twitter Post
• https://twitter.com/GuidedHacking/status/1730349970220339602 · Twitter Post
• https://twitter.com/GuidedHacking/status/1949946609602605132 · Twitter Post
• https://twitter.com/GuidedHacking/status/1949935834444001379 · Twitter Post