CVE-2006-0771 json
Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attac…
published 2006-02-18 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0777
- cvss
- 6.4
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
Format string vulnerability in PunkBuster 1.180 and earlier, as used by Soldier of Fortune II and possibly other games, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via format string specifiers in invalid cvar values, which are not properly handled when the server kicks the player and records the reason.
Exploit prediction
3.13% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Classification
- Weakness
-
- CWE-134 Use of Externally-Controlled Format String
References
-
secunia.com
/advisories/18917
third-party-advisory, vendor-advisory
-
securityfocus.com
/archive/1/425286/100/0/threaded
mailing-list
-
archives.neohapsis.com
/archives/fulldisclosure/2006-02/0372.html
mailing-list
-
securityreason.com
/securityalert/448
third-party-advisory
- aluigi.altervista.org /adv/sof2pbfs-adv.txt
-
securityfocus.com
/bid/16703
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24792
vdb-entry
Sources
- CVE List CVE-2006-0771
- NVD CVE-2006-0771
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.