CVE-2025-54065 Overview
CVE-2025-54065 is a code execution vulnerability in GZDoom, an open source port of the Doom engine. The flaw affects versions 4.14.2 and earlier. ZScript actor state handling permits scripts to read arbitrary memory addresses, write constants into the JIT-compiled code section, and redirect control flow through crafted FState and VMFunction structures. An attacker who supplies a malicious mod or map can achieve arbitrary code execution on the player's system. The issue is classified under [CWE-913] Improper Control of Dynamically-Managed Code Resources.
Critical Impact
Malicious ZScript content can hijack control flow and execute attacker-supplied bytecode in the context of the GZDoom process.
Affected Products
- GZDoom versions 4.14.2 and earlier
- ZDoom ZScript runtime
- GZDoom JIT-compiled code section
Discovery Timeline
- 2025-12-03 - CVE-2025-54065 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54065
Vulnerability Analysis
GZDoom exposes ZScript, a scripting language used by mods and maps to define actor behavior. Actor state handling in ZScript does not sufficiently isolate script-controlled data from engine control structures. A script can copy FState structures into a writable buffer, then modify function pointers and state transitions inside that copy. When the engine consumes the tampered state, it dereferences attacker-controlled VMFunction pointers and executes attacker-controlled bytecode. The vulnerability requires local access, low privileges, and user interaction such as loading a malicious mod, PK3, or WAD file.
Root Cause
The root cause is improper control of a dynamically managed code resource [CWE-913]. ZScript allows read access to arbitrary addresses and permits writes into the JIT code section. Trust boundaries between script-supplied data and engine-owned control structures are absent, letting scripts corrupt function pointers used by the virtual machine.
Attack Vector
Exploitation requires a user to load an attacker-supplied ZScript payload into GZDoom. The payload copies FState structures into a writable buffer, rewrites function pointers and state transitions, and triggers the engine to dispatch through the corrupted structures. Control flow lands in attacker-crafted bytecode staged in the JIT code section, resulting in arbitrary code execution inside the game process. See the GitHub Security Advisory for the vendor description.
Detection Methods for CVE-2025-54065
Indicators of Compromise
- Unexpected child processes spawned by the gzdoom binary during or after loading community content
- Modifications to memory regions marked executable by the GZDoom JIT allocator that occur during ZScript execution
- Loading of untrusted PK3, PK7, or WAD files sourced from unofficial distribution channels
Detection Strategies
- Monitor endpoints for process lineage anomalies where gzdoom spawns shells, scripting hosts, or network utilities
- Alert on writes to executable memory pages inside the GZDoom process address space
- Inspect user-loaded mod archives for ZScript that manipulates FState or VMFunction structures via memory buffers
Monitoring Recommendations
- Track installation and execution of GZDoom builds and record the version reported at launch
- Log file access to directories used for user mods and correlate with subsequent process activity
- Forward GZDoom process telemetry to a centralized data lake for retrospective hunting
How to Mitigate CVE-2025-54065
Immediate Actions Required
- Upgrade GZDoom to a release later than 4.14.2 once published by the ZDoom project
- Restrict use of GZDoom to mods and maps from trusted sources only
- Remove unverified PK3, PK7, and WAD files from user content directories
Patch Information
Refer to the GZDoom GitHub Security Advisory GHSA-prhc-chfw-32jg for fix status and updated release information. Apply the vendor-supplied patched build as soon as it is available.
Workarounds
- Run GZDoom under a non-privileged user account isolated from sensitive data
- Avoid loading ZScript-heavy mods obtained from untrusted forums, chat servers, or file shares
- Disable auto-loading of community content and require explicit review before launching new mods
# Configuration example
# Verify installed GZDoom version before loading community content
gzdoom --version
# Launch GZDoom without auto-loading user mods
gzdoom -iwad doom2.wad -noautoload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
