CVE-2003-1432: Epic Games Unreal Engine

High severity, CVSS 10.0. EPSS: 7.5% chance of exploitation in the next 30 days.

Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execute arbitrary code via (1) a packet with a negative size value, which is treated as a large positive number during memory allocation, or (2) a negative size value in a package file.

Affected products

• Epic Games Unreal Engine: version 226f only; version 433 only; version 436 only
• Epic Games Unreal Tournament 2003: version 2199_linux only; version 2199_win32 only; version demo_version_2206_linux only; version demo_version_2206_win32 only

Published 2003-12-31. Last modified 2026-06-16.