CVE-2006-1194

CVE-2006-1194 describes an integer signedness error in the ENet library (CVS version Jul 2005 and earlier), specifically within the enet_protocol_handle_incoming_commands function. This flaw affects applications utilizing ENet, such as Cube, Sauerbraten, and Duke3d_w32. A remote attacker can exploit this by sending a packet with a large command length, leading to an invalid memory access and causing a denial of service (application crash). The vulnerability has a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P), indicating a network-exploitable vulnerability with low attack complexity, requiring no authentication, and resulting in partial availability impact. While there is an ExploitDB entry (EDB-27420) detailing multiple denial of service vulnerabilities in ENet, there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.