PT-2026-4863 · Unknown · Cardboardpowered Cardboard

Titan Team · Published 2026-01-27 · Updated 2026-01-27 · CVE-2026-24794

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions CardboardPowered cardboard versions prior to 1.21.4

Description A flaw exists in CardboardPowered cardboard related to improper restriction of operations within the bounds of a memory buffer. This issue is located in the WorldImpl.Java file within the org/cardboardpowered/impl/world modules. The vulnerability is present in the chunk unloading code and can lead to a denial-of-service condition. Exploitation does not require authentication and can occur remotely via network access.

Recommendations Update CardboardPowered cardboard to version 1.21.4 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-24794

Affected Products

Cardboardpowered Cardboard

References · 4

• https://github.com/CardboardPowered/cardboard/pull/506 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24794 · Security Note
• https://twitter.com/0dayPublishing/status/2016068998593413493 · Twitter Post
• https://twitter.com/CVEnew/status/2016073221192228988 · Twitter Post