CVE-2007-3917
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers...
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
Exploit likelihood
What each source reports
NVD Score used
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
- Record
CVE-2007-3917- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
- Record
CVE-2007-3917- Updated
- 2026-11-02
EUVDEUVD-2007-3901 No score
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
- Record
EUVD-2007-3901- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5x5x-c9q8-x83f No score
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers...
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
- Record
GHSA-5x5x-c9q8-x83f- Weakness
- CWE-134
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3917 is a high vulnerability (CVSS 7.8) in Wesnoth, published October 11, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in wesnoth 1.2-2.
References
wesnoth.org/forum/viewtopic.php?p=256618
bugzilla.redhat.com/show_bug.cgi?id=324841
osvdb.org/41711
securityfocus.com/bid/25995
svn.gna.org/viewcvs/wesnoth/tags/1.2.7/changelog?rev=20982&view=download
Show 9 moreShow less
secunia.com/advisories/27218
redhat.com/archives/fedora-package-announce/2007-October/msg00194.html
exchange.xforce.ibmcloud.com/vulnerabilities/37047
debian.org/security/2007/dsa-1386
vupen.com/english/advisories/2007/3449
nvd.nist.gov/vuln/detail/CVE-2007-3917
github.com/advisories/GHSA-5x5x-c9q8-x83f