CVE-2021-33879

CVE-2021-33879 describes a critical vulnerability in Tencent GameLoop before version 4.1.21.90, where the application downloaded updates over an insecure HTTP connection. An attacker in a Man-in-the-Middle (MITM) position could exploit this by spoofing update XML documents, replacing legitimate download URLs with links to malicious Windows executables. The vulnerability carries a CVSS score of 8.1 (HIGH), indicating a high potential for impact (confidentiality, integrity, and availability) with high attack complexity, as the only integrity check was an easily manipulated MD5 checksum. While no active exploitation, public exploit code, or significant community discussion has been observed, the nature of the flaw allows for remote code execution on affected systems.