https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2006-3401.htmlhttps://patchthecve.com/cve/CVE-2006-3401.htmlTue, 16 Jun 2026 22:26:59 +0000HIGH 7.5: Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service and possibly execute code via long CS_ITEMS values.https://patchthecve.com/cve/CVE-2006-3400.htmlhttps://patchthecve.com/cve/CVE-2006-3400.htmlTue, 16 Jun 2026 22:26:59 +0000HIGH 7.5: Stack-based buffer overflow in the CG_ServerCommand function in Quake 3 Engine as used by Soldier of Fortune 2 (SOF2MP) GOLD 1.03 allows remote attackers to cause a denial of service and possibly execute code by sending a long command from the server.https://patchthecve.com/cve/CVE-2006-3325.htmlhttps://patchthecve.com/cve/CVE-2006-3325.htmlTue, 16 Jun 2026 22:26:50 +0000MEDIUM 5.0: client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3https://patchthecve.com/cve/CVE-2006-3324.htmlhttps://patchthecve.com/cve/CVE-2006-3324.htmlTue, 16 Jun 2026 22:26:50 +0000MEDIUM 5.0: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.https://patchthecve.com/cve/CVE-2006-2875.htmlhttps://patchthecve.com/cve/CVE-2006-2875.htmlTue, 16 Jun 2026 22:25:57 +0000HIGH 7.5: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.https://patchthecve.com/cve/CVE-2006-2082.htmlhttps://patchthecve.com/cve/CVE-2006-2082.htmlTue, 16 Jun 2026 22:24:18 +0000HIGH 7.5: Directory traversal vulnerability in Quake 3 engine, as used in products including Quake3 Arena, Return to Castle Wolfenstein, Wolfenstein: Enemy Territory, and Star Trek Voyager: Elite Force, when the sv_allowdownload cvar is enabled, allows remote attackers to read arbitrary files from the server https://patchthecve.com/cve/CVE-2006-2236.htmlhttps://patchthecve.com/cve/CVE-2006-2236.htmlTue, 16 Jun 2026 22:24:37 +0000HIGH 7.6: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.https://patchthecve.com/cve/CVE-2005-0983.htmlhttps://patchthecve.com/cve/CVE-2005-0983.htmlTue, 16 Jun 2026 22:12:09 +0000MEDIUM 5.0: Quake 3 engine, as used in multiple games, allows remote attackers to cause a denial of service (client disconnect) via a long message, which is not properly truncated and causes the engine to process the remaining data as if it were network data.https://patchthecve.com/cve/CVE-2005-0430.htmlhttps://patchthecve.com/cve/CVE-2005-0430.htmlTue, 16 Jun 2026 22:11:05 +0000MEDIUM 5.0: The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown game server) and possibly crash the server via a long infostring, possibly triggering a buffer overflow.