Flightgear is an open-source flight-simulation platform comprising the core simulator and the SimGear library, a niche but visible project in the simulation and aerospace communities. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and recur through access-control and input-handling weaknesses including improper authorization, path traversal, and buffer-boundary issues that are characteristic of simulation software handling user-supplied flight data and file operations. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Flightgear over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-2090HIGH Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly exec | Jun 17, 2012 | 9.3 | 29 | NO | NO |
CVE-2025-0781CRITICAL An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level. | Jan 28, 2025 | 9.9 | 28 | NO | NO |
CVE-2012-2091HIGH Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute a | Jun 17, 2012 | 9.3 | 28 | NO | NO |
CVE-2016-9956HIGH The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script. | Feb 22, 2017 | 7.5 | 26 | NO | NO |
CVE-2017-13709HIGH In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tr | Aug 27, 2017 | 7.5 | 25 | NO | NO |
CVE-2017-8921HIGH In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the contents of a FlightGear | May 12, 2017 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Flightgear.
Media articles that mention a CVE ID that affects a product developed by Flightgear — matched by CVE ID, not by vendor name.