CVE-2017-6903

CVE-2017-6903 describes a critical vulnerability in ioquake3 and other id Tech 3 engine games, including Quake III Arena and OpenArena, stemming from insufficient content restrictions in the auto-downloading feature. This flaw allows a malicious auto-downloaded file to be loaded as native code DLLs, override user configurations, or execute bytecode to load unwanted DLLs, leading to sandbox escape. Rated 7.8 HIGH on CVSS, the vulnerability requires user interaction (UI:R) but has low attack complexity (AC:L) and local access (AV:L), with potential for high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.