CVE-2006-3324
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine ...
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Exploit likelihood
What each source reports
NVD Score used
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
CVE-2006-3324- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
CVE-2006-3324- Updated
- 2026-11-02
EUVDEUVD-2006-3321 No score
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
EUVD-2006-3321- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-86g9-3p64-q3xg No score
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine ...
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
GHSA-86g9-3p64-q3xg- Updated
- 2026-11-02
OSV No score
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
CVE-2006-3324- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3324 No score
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
- Record
DEBIAN-CVE-2006-3324- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow | 2006-07-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3324 is a medium vulnerability (CVSS 5.0) in Id Software Quake 3 Engine, published June 30, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.44%, the 91st percentile. Fixed in ioquake3 1.36+svn1788j-1.
References
svn.icculus.org/quake3?rev=804&view=rev
securityfocus.com/archive/1/438660/100/0/threaded
aluigi.altervista.org/adv/q3cfilevar-adv.txt
secunia.com/advisories/20851