CVE-2011-2764

CVE-2011-2764 describes a critical vulnerability in the ioQuake3 engine (version 1.36 and earlier) and its derivatives, including World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror. The flaw, located in the FS_CheckFilenameIsNotExecutable function, allows remote attackers to execute arbitrary code by exploiting improper file extension checks, enabling the creation of malicious DLL files through crafted third-party addons. With a CVSS score of 10.0, this vulnerability presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the high FAUCET Risk Score of 86/100 indicates its potential for severe impact if exploited.